chore: bootstrap skills library — 19 skills + installer + CI auto-tag

Phase 1 of mathias/skills extraction (infra#62 Track D — homelab
next-step plan addendum). Imports ~/dev/.skills/ verbatim (19 skill
dirs + SKILLS_INDEX.md) and adds the installation surface:

- Taskfile.yml — install / update / list / release / check targets
- install.sh — bootstrap installer for hosts without Task. Idempotent
  symlink wirer; default checkout at ~/.local/share/skills/ on every
  host; SKILLS_REF env var pins a tag (default: main).
- .gitea/workflows/release.yml — auto-tag every push to main by
  Bump-Type footer (major/minor/patch, default patch). Skipped when
  commit contains [skip-release].
- README — usage, versioning, contribution flow, secret-hygiene rule.

Phase 1 wires Claude Code only (~/.claude/skills/<name> global +
<repo>/.claude/skills/<name> per-repo). Phase 2 adds Crush, opencode,
antigravity, and gitea-resident agents (cobalt-dingo, agentsquad)
once their skill conventions are researched.

Public repo, markdown-only — no secrets, no client names. Verified
via pre-push grep before initial push.

[skip-release]

.gitea/workflows/release.yml

@@ -0,0 +1,68 @@
+name: release
+
+# Auto-tag every push to main with a semver bump derived from the latest
+# commit footer:
+#   Bump-Type: major  → vX.0.0
+#   Bump-Type: minor  → v0.Y.0
+#   (default)         → v0.0.Z (patch)
+#
+# Skips when the latest commit is itself the auto-tagger (commit message
+# contains "[skip-release]") to prevent recursion. Tag is pushed back
+# to the repo using the GITEA_TOKEN provided by act_runner.
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITEA_TOKEN }}
+
+      - name: derive next version
+        id: bump
+        run: |
+          set -euo pipefail
+          last_commit=$(git log -1 --pretty=%B)
+          if printf '%s' "$last_commit" | grep -qi '\[skip-release\]'; then
+            echo "skipping — commit marked [skip-release]"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          latest=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0")
+          major=$(echo "$latest" | sed -E 's/^v([0-9]+)\.([0-9]+)\.([0-9]+)$/\1/')
+          minor=$(echo "$latest" | sed -E 's/^v([0-9]+)\.([0-9]+)\.([0-9]+)$/\2/')
+          patch=$(echo "$latest" | sed -E 's/^v([0-9]+)\.([0-9]+)\.([0-9]+)$/\3/')
+          bump=$(printf '%s' "$last_commit" | grep -iE '^Bump-Type:' | head -1 | awk '{print tolower($2)}')
+          case "$bump" in
+            major) major=$((major + 1)); minor=0; patch=0 ;;
+            minor) minor=$((minor + 1)); patch=0 ;;
+            *)     patch=$((patch + 1)) ;;
+          esac
+          next="v${major}.${minor}.${patch}"
+          echo "previous=$latest"
+          echo "bump=${bump:-patch}"
+          echo "next=$next"
+          echo "tag=$next" >> "$GITHUB_OUTPUT"
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+
+      - name: tag + push
+        if: steps.bump.outputs.skip != 'true'
+        env:
+          TAG: ${{ steps.bump.outputs.tag }}
+          GITEA_ACTOR: ${{ gitea.actor }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          git config user.name "${GITEA_ACTOR}"
+          git config user.email "${GITEA_ACTOR}@noreply.gitea.d-ma.be"
+          git tag -a "$TAG" -m "release $TAG"
+          # gitea-actions checkout uses an x-access-token URL; reuse it.
+          git push origin "$TAG"
+          echo "pushed $TAG"