ci(skills): hide retired skills on ClawHub once the sync has run

[WaterrrForever]

What

Adds a Hide retired skills step to .github/workflows/sync-skills-to-clawhub.yml. It runs the new scripts/clawhub-unlist-retired.mjs, which hides on ClawHub every name in RETIRED_SKILLS (packages/cli/src/utils/skillsManifest.ts) that is still listed under heygen-com. Each hide records that skill's retiredSkillNotice as its moderation note. With the workflow's existing dry_run input, the step only prints the names that are still listed.

Stacked on #5651. The base is miao/oss-skills-slim, so this diff shows only the ClawHub change. Retarget to main after #5651 merges.

Why

#5651 retires 14 skills. clawhub sync stops republishing them, but each one's last version stays listed and installable on ClawHub. A public clawhub inspect heygen-com/<name> --json run today returns all 14, for example general-video 1.0.28 and hyperframes-core 1.0.42.

Related work

Refs #5651

How

What ClawHub offers (clawhub@0.23.1, the version the workflow pins; its --help, its dist/, and openclaw/clawhub docs/http-api.md):

• clawhub hide <skill> [--reason] [--yes]: "Hide one of your skills". In dist/cli/commands/delete.js, cmdHideSkill is cmdDeleteSkill with different labels. Both send DELETE /api/v1/skills/{slug} with { reason, ownerHandle }, which the API docs describe as "Soft-delete / restore a skill (owner, moderator, or admin)". clawhub unhide / clawhub undelete restore it.
• GET /api/v1/skills/{slug} returns 404 "Skill not found" for a soft-deleted skill (convex/httpApiV1/skillsV1.ts). The script inspects first and hides only a skill that still resolves, so a rerun makes no hide call.
• clawhub skill merge <source> <target> also exists. It hides the source listing and keeps the old slug as a redirect to the target. This PR does not use it (see "Left for a human" below).

The script follows scripts/clawhub-sync.mjs: an injectable run, ::error:: lines, and a non-zero exit on any refusal or on an inspect failure other than not-found. It imports RETIRED_SKILLS and retiredSkillNotice straight from the TS manifest; Node 22's default type stripping handles that, because the module imports only node: built-ins. The workflow now also triggers on changes to the script and to skillsManifest.ts. Hiding is a separate step, so publishing does not depend on it.

Left for a human

• I could not tell from here which role the CLAWHUB_TOKEN account holds on the heygen-com publisher. If it is not an owner or admin, the step fails with 403/Forbidden for each name and the job goes red. Publishing still happens in the earlier step.
• An owner-initiated soft delete reserves the slug for 30 days. After that another publisher can claim the bare slug (docs/http-api.md: "Owner-initiated soft deletes reserve the slug for 30 days, then the slug can be claimed by another publisher"). Owner-scoped refs (heygen-com/<name>) are unaffected. If the bare hyperframes-* names should stay ours, run clawhub skill merge heygen-com/<name> heygen-com/hyperframes instead (media-use for hyperframes-audio). That keeps each slug as a permanent redirect, but it is a one-way owner decision, so this PR does not automate it.

Test plan

• node --import tsx --test scripts/clawhub-unlist-retired.test.mjs scripts/clawhub-sync.test.mjs → 17 tests, 17 pass. The new tests cover: hides only the listed names; a second run hides nothing; a moderation-only inspect result counts as unlisted; dry run names without hiding; an inspect error other than not-found is reported without hiding; a refused hide is reported; and end to end with a fake clawhub on PATH, all 14 manifest names print and a refusal exits 1.
• Live dry run, no credentials (config pointed at an empty scratch directory, clawhub@0.23.1 on PATH): DRY_RUN=true node scripts/clawhub-unlist-retired.mjs → exit 0 and "Retired skills still listed on ClawHub (dry run):" followed by all 14 names.
• Without DRY_RUN and with no token, every hide stops locally with Error: Not logged in. Run: clawhub login and the script exits 1. No request is sent.
• bun run lint → exit 0 (0 warnings, 0 errors)
• bunx oxfmt --check on the four changed files → "All matched files use the correct format."
• COMMENT_CHECK_BASE=origin/miao/oss-skills-slim node scripts/check-comment-citations.mjs → comments: OK (2 file(s) examined of 4 in scope); comment-ratchet.mjs → OK
• bun run test:scripts → 728 pass, 5 fail. The failures (creator-editing-recipes, generate-catalog-previews, verify-catalog-payloads) fail the same way on the feat(skills)!: publish seven knowledge skills aligned with Studio and retire the workflow skills #5651 base without this change.
• Unit tests added
• Documentation updated: not applicable

No visible change

CI and scripts only. Nothing under packages/studio or packages/player changes.

🤖 Generated with Claude Code