feat(skills): add bumping-opencoder-versions project skill

[tankdonut]

What

Promotes the bumping-opencoder-versions skill from user-level (~/.agents/skills/) to a project-level skill at .agents/skills/bumping-opencoder-versions/SKILL.md. This ships the bumping playbook with the repo so it's available to anyone (human or agent) working on opencoder.

Why

The skill was authored and iteratively refined against this repo (PR #62) and is project-specific — it has no use outside tankdonut/opencoder. User-level was fine for first authoring; project-level is the right home for ongoing maintenance.

Coverage

Four Renovate-blind version surfaces (Renovate owns the rest via config:recommended):

#	Surface	Tool
1	OpenCode core (.opencode-version + .opencode-checksums)	scripts/bump-version.sh
2	npm plugins in opencode.json + tui.json (with alignment invariant)	jq --indent 4 edit
3	skills@X.Y.Z pin in markdown docs (4 files)	sed -i across all four
4	skills-lock.json computedHash values	regenerate via skills CLI

Plus:

• 7-day embargo fallback policy (matches Renovate's minimumReleaseAge behavior — fall back to latest eligible, don't skip)
• Two-tier verification protocol: validate.sh always; build.sh + container-test.sh only with explicit user OK (5–20+ min each)
• Live-tested jq recipes for npm and GitHub Releases embargo filtering
• Common-mistake and red-flag tables covering the failure modes observed during PR chore(deps): bump renovate-blind version surfaces #62 (e.g. plain jq defaults to 2-space indent → noisy diff; latest version embargoed → skip is wrong, fall back is right)

Validation

• Skill was executed end-to-end via subagent in PR chore(deps): bump renovate-blind version surfaces #62 — all four surfaces bumped correctly, plugin alignment invariant preserved, validate.sh green
• Pre-commit hooks pass on this commit (large files, merge conflicts, private key, trailing whitespace, shellcheck)
• No code changes, no container changes — documentation only

Follow-ups considered and rejected

• Adding to build/skills-lock.json: rejected, that's for skills.sh registry skills from external repos, not project-local skills
• Baking into the container image: rejected, the bumping skill is for working ON opencoder, not for using opencode to develop other projects
• Updating root AGENTS.md to mention the skill: deferred — can be a follow-up if the convention emerges that project skills should be enumerated there