feat(skills): skill marketplace v0 — sell + rate skills as units (bundle download + skill-as-a-service)

- ServiceOffer type=skill (spec.skill: name/version/sha256/bundleConfigMap, CEL
  guard); controller validates bundle CM (existence/900KB cap/sha256 match) and
  renders a restricted-PSS busybox httpd bundle server behind the standard
  Middleware+HTTPRoute publish path; anti-spoof: upstream pinned to the
  controller-rendered workload name
- 402 extra.skill {name,version,sha256} surfaced free pre-purchase (additive)
- obol sell skill (--from/--from-embedded, deterministic tar via
  internal/skillpkg, warn-only secret scan, server-side CM apply, resume-ledger
  bundle) + --as-service sugar over type=agent
- obol skills calldata set-hash|feedback (tag1=asr:skill, ERC-8239 PR#1704
  interim tag2), reputation (getSummary + --raters whitelist), verify
  (on-chain sha256 vs local bundle); operator submits, controller never signs
- hermes-skill-publish Role (namespace-scoped CM create/get/update/patch) gated
  by new VAP rule: agent ConfigMap writes must be *-skill-bundle — hermes-config
  untouchable; agent-side publish documented in sell/monetize-guide skills
- flows/flow-19-skill-sale.sh + docs/guides/skill-marketplace.md
- review: high (binary-corrupting buy.py download instructions) fixed in-flow;
  post-review hand fixes: 63-char Service/label cap on workload names, VAP
  ConfigMap guard, sell delete cleans bundle CM, secret-scan errors surfaced,
  doc drift

Author: bussyjd

cmd/obol/main.go

@@ -325,6 +325,7 @@ GLOBAL OPTIONS:{{template "visibleFlagTemplate" .}}{{end}}
 			openclawCommand(cfg),
 			sellCommand(cfg),
 			buyCommand(cfg),
+			skillsCommand(cfg),
 			modelCommand(cfg),
 			{
 				Name:  "app",

cmd/obol/sell.go

@@ -53,6 +53,7 @@ func sellCommand(cfg *config.Config) *cli.Command {
 			sellHTTPCommand(cfg),
 			sellMCPCommand(cfg),
 			sellAgentCommand(cfg),
+			sellSkillCommand(cfg),
 			sellDemoCommand(cfg),
 			sellListCommand(cfg),
 			sellStatusCommand(cfg),
@@ -2811,10 +2812,30 @@ func sellDeleteCommand(cfg *config.Config) *cli.Command {
 			// controller renders an active:false / x402Support:false tombstone
 			// document while keeping the agentId.
 
+			// For type=skill offers the bundle ConfigMap is CLI/agent-created
+			// (not controller-owned, so no ownerRef GC). Capture its name
+			// before the offer disappears and delete it afterwards.
+			bundleCM := ""
+			{
+				bin, kubeconfig := kubectl.Paths(cfg)
+				if out, err := kubectl.Output(bin, kubeconfig, "get", "serviceoffers.obol.org", name, "-n", ns,
+					"-o", "jsonpath={.spec.type}/{.spec.skill.bundleConfigMap}"); err == nil {
+					if typ, cm, ok := strings.Cut(strings.TrimSpace(out), "/"); ok && typ == "skill" && cm != "" {
+						bundleCM = cm
+					}
+				}
+			}
+
 			if err := kubectlRun(cfg, "delete", "serviceoffers.obol.org", name, "-n", ns); err != nil {
 				return err
 			}
 
+			if bundleCM != "" {
+				if err := kubectlRun(cfg, "delete", "configmap", bundleCM, "-n", ns, "--ignore-not-found"); err != nil {
+					u.Warnf("could not delete skill bundle ConfigMap %s/%s: %v", ns, bundleCM, err)
+				}
+			}
+
 			// Drop the offer's manifest from the resume ledger so the next
 			// `obol stack up` / `obol sell resume` doesn't replay an offer
 			// the operator just deleted. Covers every ledger-persisted type
@@ -4793,7 +4814,10 @@ func resumePersistedServiceOffers(cfg *config.Config, u *ui.UI) error {
 	u.Blank()
 	u.Infof("Resuming %d locally-persisted sell offer(s)...", len(manifests))
 	for _, m := range manifests {
-		if err := kubectlApply(cfg, m.Manifest); err != nil {
+		// resumeApplyManifest (sell_skill.go) routes ConfigMap items in
+		// List bundles through server-side apply; skill bundle payloads
+		// overflow the client-side last-applied annotation otherwise.
+		if err := resumeApplyManifest(cfg, m.Manifest); err != nil {
 			u.Warnf("resume %s %s/%s: %v", m.label(), m.Namespace, m.Name, err)
 			continue
 		}