ref(skill-drift): scan references/sdks instead of legacy skills

[evanpurkhiser]

The per-SDK skills the nightly drift automation used to keep fresh have moved to skills-legacy/ (#265) and are now frozen. The maintained platform content lives in the references/sdks/<sdk>/ trees, so this repoints the automation there.

• Matrix (.github/skill-drift-matrix.json): the unit is now an SDK slug (sdk: python) rather than a skill name, matching the reference directory names. repo / path_filter / team are unchanged.
• Detect job: the sandboxed Claude session reads references/sdks/<sdk>/ (index.md plus the per-signal files) and is told to conform edits to references/sdks/STRUCTURE.md. Its file-edit allowlist, the summary.json schema (.sdk instead of .skill), and the artifact staging all target that tree.
• Apply job: the path allowlist, rsync overlay, branch/slug naming, and the prompt-injection guard (now a bare-slug check instead of the sentry-*-sdk pattern) all operate on references/sdks/<sdk>/.

The security model is unchanged — read-only detect job, deterministic apply job, path allowlists enforced in both.

Sequencing: this reads the checked-out tree at run time and only fires weekly (or on manual dispatch), so it activates once references/ lives at the repo root via the skills-next merge. Should land alongside that merge and #265.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3748d3e. Configure here.}

[cursor]

Bare SDK slug false dedupe

Medium Severity

Step 1 tells the detect agent to treat any open [skill-drift] PR or issue whose title contains the bare SDK slug as already covered. Short slugs like go or react match as substrings in unrelated titles (e.g. legacy sentry-go-sdk titles or other words), so the run can emit no_drift and skip real reference updates.

 

^{Reviewed by Cursor Bugbot for commit 3748d3e. Configure here.}