@lead: externalize agent.yml inline scripts into .gitea/workflows/scripts/*.sh

Rebased onto the per-agent skill-scoping change so PR #25 carries both:
- route.sh keeps the registry 'skills' allow-list and emits skills as a step output
- install-opencode.sh writes the permission.skill block (deny-all + allow listed)

Pure refactor otherwise: each step's shell moves to its own file, called via
bash "$SCRIPTS/<name>.sh". The two extracted SKILL.md bodies are byte-identical to
main; routing/config/publish behavior is unchanged. Because this is a reusable
workflow (workflow_call) the runtime checkout is the caller's repo, so agent.yml now
checks THIS repo out into .agents-workflow/ (pinned @main) and points $SCRIPTS there.

.gitea/workflows/scripts/fetch-images.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Inspect / fetch image attachments (download only for vision agents).
+# Emits step outputs: has_images (count) and files (opencode -f flags for downloaded images).
+#
+# Required env (provided by the workflow step): GT NUM VISION GITHUB_SERVER_URL GITHUB_REPOSITORY GITHUB_OUTPUT
+set -eu
+
+API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
+mkdir -p /tmp/att
+curl -sS -H "Authorization: token $GT" "$API/issues/$NUM/assets" > /tmp/att/list.json || echo '[]' > /tmp/att/list.json
+imgcount=$(jq '[.[]? | select(.name|test("\\.(png|jpe?g|gif|webp)$";"i"))] | length' /tmp/att/list.json 2>/dev/null || echo 0)
+echo "has_images=$imgcount" >> "$GITHUB_OUTPUT"
+files=""
+if [ "$VISION" = "true" ] && [ "${imgcount:-0}" -gt 0 ]; then
+  i=0
+  while IFS=$'\t' read -r url name; do
+    [ -z "$url" ] && continue
+    ext="${name##*.}"
+    case "$ext" in
+      png|jpg|jpeg|gif|webp|PNG|JPG|JPEG|GIF|WEBP)
+        i=$((i+1)); out="/tmp/att/img_$i.${ext,,}"
+        if curl -sSL -H "Authorization: token $GT" -o "$out" "$url" && [ -s "$out" ]; then
+          files="$files -f $out"; echo "saved '$name' -> $out"
+        fi ;;
+    esac
+  done < <(jq -r '.[]? | "\(.browser_download_url)\t\(.name)"' /tmp/att/list.json 2>/dev/null)
+fi
+echo "files=$files" >> "$GITHUB_OUTPUT"