fix(skills): use GitHub CLI for RPI bootstrap

- replace the custom downloader with pinned gh skill installs
- retain the explicit eight-skill allowlist and workflow contract

🔧 - Generated by Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: algattik

.github/copilot-instructions.md

@@ -332,15 +332,15 @@ The weekly `copilot-setup-steps.yml` cron and `Test-BinaryFreshness.ps1` weekly
 
 ### Cloud-Agent RPI Skills
 
-The `Bootstrap hve-core RPI skills` step in `copilot-setup-steps.yml` runs **outside** the cloud-agent firewall and downloads the complete RPI skill suite from a pinned `microsoft/hve-core` commit into immediate subdirectories of `.github/skills/`.
+The `Bootstrap hve-core RPI skills` step in `copilot-setup-steps.yml` runs **outside** the cloud-agent firewall and uses `gh skill install` to download the complete RPI skill suite from a pinned `microsoft/hve-core` commit into immediate subdirectories of `.github/skills/`.
 
-The generated `.github/skills/rpi-*/` directories are gitignored and excluded from repository Markdown linting. The standalone bootstrap script stages downloads before installation, accepts Markdown blobs only, verifies each pinned Git blob SHA, requires all eight skill entry points, rejects unexpected top-level content, and records the resolved commit, file paths, and blob SHAs in `.github/skills/.rpi-audit.json`. Bootstrap failure is fatal because no local fallback provides these workflows.
+The generated `.github/skills/rpi-*/` directories are gitignored and excluded from repository Markdown linting. The setup step names all eight allowed skill paths explicitly, pins every installation to the reviewed commit, and relies on the GitHub CLI to preserve each skill's references and templates and inject its source commit and tree metadata into `SKILL.md`. Bootstrap failure is fatal because no local fallback provides these workflows.
 
 The cloud agent discovers the `rpi-quick`, `rpi-research`, `rpi-plan`, `rpi-implement`, and `rpi-review` workflows directly from their `SKILL.md` files. The bootstrap also preserves `rpi-challenger`, `rpi-plan-critique`, `rpi-walkthrough`, and every bundled reference and template.
 
-The current immutable commit predates a published hve-core release containing the skill-forward layout. Prefer a released commit on upgrades; when none exists, review the complete upstream commit and tree before changing `UPSTREAM_REF`.
+The current immutable commit predates a published hve-core release containing the skill-forward layout. Prefer a released commit on upgrades; when none exists, review the complete upstream commit and tree before changing `RPI_SKILLS_REF`.
 
-Before starting RPI work, verify `.github/skills/.rpi-audit.json` exists and contains the expected pinned `resolved_sha`; otherwise stop with a bootstrap failure. Treat `.copilot-tracking/` files as session scratch because the directory is gitignored.
+Before starting RPI work, verify each required `.github/skills/rpi-*/SKILL.md` exists and its `metadata.github-pinned` value matches `RPI_SKILLS_REF`; otherwise stop with a bootstrap failure. Treat `.copilot-tracking/` files as session scratch because the directory is gitignored.
 
 In cloud-agent PR work, persist each completed RPI phase as a PR comment and maintain an `RPI Artifact Index` in the PR description with the phase comment links and resolved upstream SHA. If PR write tools are unavailable, include the complete phase artifacts in the final response rather than claiming durable persistence.
 

.github/instructions/shell-scripts.instructions.md

@@ -100,10 +100,6 @@ info "Operation complete"
 
 <!-- <important-conventions> -->
 
-Standalone trust-bootstrap scripts under `scripts/ci/` may omit `common.sh`,
-argument parsing, `--config-preview`, and deployment summaries when sourcing
-repository helpers would widen the bootstrap trust boundary.
-
 **Arguments:**
 
 - Short: `-h`, `-t` | Long: `--help`, `--tf-dir`

.github/workflows/copilot-setup-steps.yml

@@ -14,11 +14,9 @@ on:
   push:
     paths:
       - .github/workflows/copilot-setup-steps.yml
-      - scripts/ci/bootstrap-hve-core-rpi-skills.sh
   pull_request:
     paths:
       - .github/workflows/copilot-setup-steps.yml
-      - scripts/ci/bootstrap-hve-core-rpi-skills.sh
   # Weekly drift check: surfaces broken action SHAs, yanked packages, or
   # registry outages on a Monday morning instead of mid-Copilot-session.
   schedule:
@@ -125,14 +123,30 @@ jobs:
 
       # Run the external-content bootstrap last. A failed Copilot setup step
       # skips later steps but still starts the agent with the completed setup.
-      # UPSTREAM_REF is pinned to the reviewed skill-consolidation commit because
+      # RPI_SKILLS_REF is pinned to the reviewed skill-consolidation commit because
       # no published hve-core release contains this skill layout. Prefer a release
       # SHA on future upgrades; otherwise review the commit and complete tree.
       - name: Bootstrap hve-core RPI skills
         env:
           GH_TOKEN: ${{ github.token }}
           # microsoft/hve-core derived-files release: hve-core-v3.2.2 (2026-03-23)
           HVE_CORE_DERIVED_FILES_REF: e69486a5f809ede45c63c0a31358c12912bd5168
-          UPSTREAM_REPO: microsoft/hve-core
-          UPSTREAM_REF: 130ab64338bb77e912e603693672c31f14bc60c6
-        run: bash scripts/ci/bootstrap-hve-core-rpi-skills.sh
+          RPI_SKILLS_REF: 130ab64338bb77e912e603693672c31f14bc60c6
+        run: |
+          skills=(
+            rpi-quick
+            rpi-research
+            rpi-plan
+            rpi-implement
+            rpi-review
+            rpi-challenger
+            rpi-plan-critique
+            rpi-walkthrough
+          )
+          for skill in "${skills[@]}"; do
+            gh skill install microsoft/hve-core \
+              ".github/skills/rpi/${skill}/SKILL.md" \
+              --pin "$RPI_SKILLS_REF" \
+              --dir .github/skills \
+              --force
+          done

.gitignore

@@ -466,9 +466,6 @@ venv/
 .agent/
 .copilot-tracking/
 .github/skills/rpi-*/
-.github/skills/.rpi-audit.json
-.github/skills/.rpi-backup.*
-.github/skills/.rpi-staging.*
 
 # Environment-specific deployment artifacts
 infrastructure/setup/generated/

.markdownlint-cli2.jsonc

@@ -4,8 +4,6 @@
     ".agent/reviews/**",
     ".copilot-tracking/**",
     ".github/skills/rpi-*/**",
-    ".github/skills/.rpi-backup.*/**",
-    ".github/skills/.rpi-staging.*/**",
     "venv/**",
     ".venv/**",
     "**/.venv/**",

docs/reference/copilot-artifacts.md

@@ -4,7 +4,7 @@ description: >-
   Inventory and reference for GitHub Copilot agents, instructions, prompts,
   and skills configured in this repository.
 author: Microsoft Robotics-AI Team
-ms.date: 2026-08-18
+ms.date: 2026-09-01
 ms.topic: reference
 keywords:
   - copilot
@@ -139,15 +139,13 @@ discovery (frontmatter only) → instructions (SKILL.md body) → resources
 
 ### rpi-* skill suite
 
-The cloud-agent setup workflow downloads the complete RPI skill suite from
-a pinned `microsoft/hve-core` commit into gitignored `.github/skills/rpi-*/`
-directories. Each skill is an immediate child of `.github/skills/`, as required
-for discovery. Local clones do not contain these skills unless the setup
-workflow has provisioned them. Each skill retains its upstream references and
-templates, and `.github/skills/.rpi-audit.json` records the resolved commit,
-installed file paths, and verified Git blob SHAs. All eight skill entry points
-are required. Unexpected top-level content fails bootstrap rather than changing
-the installed skill surface implicitly.
+The cloud-agent setup workflow uses `gh skill install` to download eight
+explicit RPI skill paths from a pinned `microsoft/hve-core` commit into
+gitignored `.github/skills/rpi-*/` directories. Each skill is an immediate
+child of `.github/skills/`, as required for discovery. Local clones do not
+contain these skills unless the setup workflow has provisioned them. Each skill
+retains its upstream references and templates, and the GitHub CLI injects the
+source commit and tree metadata into its `SKILL.md` front matter.
 
 | Skill               | Purpose                                             |
 |---------------------|-----------------------------------------------------|

scripts/README.md

@@ -2,7 +2,7 @@
 title: Scripts
 description: CI/CD scripts, shared libraries, linting, security, and Pester tests for the Physical AI Toolchain.
 author: Microsoft Robotics-AI Team
-ms.date: 2026-07-06
+ms.date: 2026-09-01
 ms.topic: reference
 keywords:
   - scripts
@@ -49,7 +49,6 @@ CI bootstrap and release automation.
 
 | Script                                | Purpose                                                 |
 |---------------------------------------|---------------------------------------------------------|
-| `ci/bootstrap-hve-core-rpi-skills.sh` | Provision the verified RPI skill suite for cloud agents |
 | `ci/Add-ReleaseVerificationNotes.ps1` | Add release verification notes                          |
 | `ci/Close-ReleaseMilestone.ps1`       | Close the milestone associated with a completed release |
 | `ci/Install-Gitsign.ps1`              | Install the pinned gitsign release                      |