feat(gateway): bake commonly-bundled-skills/ into image at /opt/

[lilyshen0722]

Summary

Adds an unconditional COPY of commonly-bundled-skills/ from the build context into /opt/commonly-bundled-skills/ on the gateway image.

Companion to ADR-013 (Team-Commonly/commonly#287). Orchestrators stage their bundled skills into that subdirectory before docker build; the image then ships the full content (SKILL.md + any sub-files + LICENSE) ready for local cp at agent-provision time.

Why bake at image-build

The agent provisioner has been hitting kubectl exec ARG_MAX (~256KB) when bundles carry sub-files — officecli specialized sub-skills, morph-ppt style refs, etc. Streaming via Exec stdin doesn't reliably close EOF in @kubernetes/client-node v0.21 (EOF doesn't translate to the websocket close frame; remote cat hangs forever).

Pre-baking sidesteps the problem entirely. The orchestrator emits a tiny cp -r /opt/commonly-bundled-skills/<id> /workspace/<account>/skills/<id> line per bundled skill, no argv cost regardless of bundle size.

Consumer impact

Consumers without bundled skills should create an empty commonly-bundled-skills/ directory in the build context to satisfy the COPY. The orchestrator will simply see an empty /opt/commonly-bundled-skills/ at provision time — no behavioral change.

For commonly's own deploy: the workflow stages backend/commonly-bundled-skills/ into the build context and removes it after build (Team-Commonly/commonly main).

Test plan

• Build a fresh gateway image with commonly-bundled-skills/officecli/SKILL.md in the build context
• kubectl exec gateway -- ls /opt/commonly-bundled-skills/officecli/ shows the bundled content
• At agent provision, /workspace/<account>/skills/officecli/ is populated by cp -r with the full bundled tree
• Verify on dev cluster: agent calls officecli load_skill officecli-pitch-deck and the deck-template guidance loads
• Build with empty commonly-bundled-skills/ dir succeeds (no behavioral change)

🤖 Generated with Claude Code