feat: add codex ui metadata

[MarioCadenas]

Summary

Adds Codex UI metadata to every skill and refactors the build tooling so each skill directory is self-contained (assets copied in)

Main changes

Codex marketplace metadata (skills/*/agents/openai.yaml):
Each skill now ships an agents/openai.yaml with interface fields (display_name, short_description, icon_small/icon_large, brand_color, default_prompt). These are installed as files by the CLI and consumed by Codex for marketplace display.

Self-contained skill directories with asset sync (scripts/skills.py):
Renamed scripts/generate_manifest.py to scripts/skills.py and expanded it into a three-mode tool: sync copies shared assets (assets/databricks.{svg,png}) from repo root into each skill's assets/ dir (idempotent, preserves mtime via copy2); generate runs sync then writes manifest.json with plain relative paths (no @root: prefix); validate checks both asset sync state and manifest freshness, printing a fix command on failure.

Skill rename: databricks to databricks-core (manifest.json):
The old databricks skill entry (which mapped to skills/databricks/) is replaced by databricks-core (mapping to skills/databricks-core/). The orphan skills/databricks/ directory is removed.

Supporting infrastructure

• assets/databricks.svg — Shared Databricks vector logo (source of truth for all skills).
• assets/databricks.png — Shared Databricks raster logo.
• skills/*/assets/databricks.{svg,png} — Per-skill copies generated by scripts/skills.py sync.

Other changes

• .github/workflows/validate-manifest.yml updated to reference scripts/skills.py validate and trigger on assets/** changes.
• CLAUDE.md and README.md updated to document the new scripts/skills.py commands (sync, generate, validate).

Preview

Skills installer

In chat

All skills installed

Codex UI will have this skill openai/skills#307 that uses the CLI to install the rest

Documentation safety checklist

• Examples use least-privilege permissions (no unnecessary ALL PRIVILEGES, admin tokens, or broad scopes)
• Elevated permissions are explicitly called out where required
• Sensitive values are obfuscated (placeholder workspace IDs, URLs, no real tokens)
• No insecure patterns introduced (e.g. disabled TLS verification, hardcoded credentials)

[arsenyinfo]

A single nitpick: imo a verb is a better choice for a script name, but overall LGTM!