slice 3.5c: seed 15 built-in skills across the 6 stacks

Hand-authored skill catalog anchored to real 2026-07 versions:
  - Rust 1.97.1 (stable), edition 2024
  - React 19.2.7, Server Components + Actions
  - TailwindCSS 4.3.3 (CSS-first config, Oxide engine)
  - three.js r185 (WebGPURenderer stable, BatchedMesh matured)
  - React Native 0.86 / Expo SDK 54+ (New Architecture default)
  - cargo-nextest 0.9.140, gitleaks 8.20+, cargo-audit 0.21+
  - Postgres 17 (18 in beta, don't rely on)
  - CUDA Blackwell, Metal Apple7+, ROCm CDNA3

Ships 15 skills across the categories:
  foundation/  workspace-repo-commit-protocol
               small-focused-commits
               tdd-red-green-refactor
               code-review-checklist
               int-xx-marker-protocol
               decompose-int-items
  rust/        write-rust-current-edition
               rust-error-handling
               cargo-test-driven-development
               rust-async-tokio-idioms
  backend/     postgres-migrations-forward-only
               postgres-index-selection
               api-pagination-day-1
  frontend/    react-19-server-components
               tailwind-v4-idioms
               component-4-state-model
  mobile/      expo-managed-vs-bare
               rn-flashlist-perf
  gpu/         gpu-coalescing-and-occupancy
               roofline-model
  threejs/     threejs-perf-and-teardown
  security/    cargo-audit-workflow
               secret-scanning-gitleaks

skills_loader.rs walks skills/**/*.md, parses YAML frontmatter
(name, description, when_to_use, tags), upserts via
skills_catalog::upsert_builtin. Idempotent per boot — bumps version
+ appends skill_versions row ONLY when body changes. Deterministic
sha256-derived ids so builtins are stable across boots.

Dockerfile copies skills/ to /etc/clawmates/skills. Server boot
task spawns loader alongside team_template_loader.

Follow-ups (Slice 3.5c continuation, future PRs):
  - 20-30 more skills (duckdb, shadcn composition, a11y, WebGPU
    migration, metal frame capture, rocprof, deep gitea forge
    integration, semgrep rulepacks)
  - Bind skills to team template roles (add [role.skills] refs to
    templates/teams/*.toml + wire template_role_skills population
    in team_template_loader)

Co-Authored-By: Claude Opus 4.7 <[email protected]>

skills/mobile/expo-managed-vs-bare.md

@@ -0,0 +1,56 @@
+---
+name: expo-managed-vs-bare
+description: Default to Expo managed workflow; drop to bare only for capabilities Expo hasn't shipped. Expo SDK 54+ (RN 0.86) baseline.
+when_to_use: Starting or expanding an Expo/React Native app. Mobile team pins.
+tags: [mobile, expo, react-native, versioned]
+---
+
+# Expo managed vs bare (SDK 54+, RN 0.86)
+
+Anchored to **Expo SDK 54** (2026 line) shipping React Native 0.86 as of 2026-07. New Architecture is default; JSC is removed; Hermes-only.
+
+## Managed by default
+
+- One codebase, `expo prebuild` on demand to regenerate iOS/Android projects.
+- OTA updates via EAS Update.
+- Config Plugins system covers 95% of native customization without ejecting.
+
+## When to drop to bare
+
+- Custom native modules with no Expo Module wrapper (rare — Expo Modules API covers most cases now).
+- Fork of React Native itself.
+- Vendor SDK that ships only a `.aar` or `.xcframework` with a config that Expo Config Plugins can't express.
+
+If none of the above, stay managed. `expo prebuild` gives you the native project when you need to poke it, without permanent ejection.
+
+## SDK version alignment
+
+- Expo SDK N ships against a specific RN version. Don't `yarn add react-native@latest` — use `expo install react-native` so you get the version the SDK bundles.
+- Expo SDK is released ~quarterly; RN follows ~monthly. Follow Expo's calendar, not RN's.
+- Native modules published to npm should declare `expo-modules-core` peer dep with a range covering the current + previous SDK.
+
+## Config Plugins
+
+- `app.config.ts` over `app.json` — you get typing + can compute values (env-branched dev/staging/prod).
+- Plugins compose: `[plugins]: ["expo-notifications", ["./plugins/withCustomEntitlement", { key: "..." }]]`.
+- Custom plugins live in `plugins/` and are typed by `ConfigPlugin<Props>`.
+
+## EAS Build
+
+- Two profiles minimum: `development` (dev client, sim + device), `production` (store submission).
+- `eas.json` per-branch overrides for env vars; secrets go into EAS Secrets, never repo.
+- **Fingerprint** (SDK 51+) determines rebuild need — if your JS-only change fingerprints identically, no native rebuild. Saves 15+ min per iteration.
+
+## When Bare IS the answer
+
+- Deep customization of the launcher / splash screen beyond `expo-splash-screen` capabilities.
+- Multi-target apps (main + share extension + widget) where Expo's single-target model doesn't fit.
+- Enterprise MDM constraints that require unusual entitlements.
+
+If you go bare, keep the Expo dep chain (`expo`, `expo-modules-core`) — you still benefit from `expo-router`, `expo-notifications`, etc. Bare ≠ vanilla RN.
+
+## Anti-patterns
+
+- **Ejecting to bare because a StackOverflow answer said so.** Search for a Config Plugin first.
+- **Mixing `react-native init` with `expo` deps.** Pick one project generator; don't try to retrofit.
+- **Locking to a beta SDK for production.** Expo betas are for testing your app against the next SDK, not for shipping.