[docs, ci] feat: add bump-dependency skill and fix L2 trigger docs

[ko3n1g]

Claude summary

What

1. Add skills/bump-dependency/SKILL.md — end-to-end workflow for shipping a dependency-bump PR (TE / MCore / git-pinned override) and driving it to green.
2. Fix a long-standing inaccuracy across the docs: L2 functional tests can be triggered per-PR by the full-test-suite label, not only on schedule / workflow_dispatch.
3. Trim duplications: removed content from the new skill that already lives in @CONTRIBUTING.md, @skills/build-and-dependency/SKILL.md, @skills/cicd/SKILL.md, and @skills/testing/SKILL.md, replacing it with @<path> references. The skill now keeps only the bump-specific narrative — orchestration arc, watchdog script, iteration loop — and trims sections like worktree creation, uv lock mechanics, sign-off boilerplate, /ok to test semantics, and the git mv quarantine recipe to one-line pointers (-97 lines, +61 lines = net -36 lines).

Why

Distilled from the recent TE release_v2.15 bump (#3672). Two things were notable enough to bake into the skill:

1. Always attach a watchdog (the Monitor tool) — never a cronjob or scheduled wakeup. Wakeups poll on a clock; a watchdog reacts on every job edge in the CICD NeMo workflow and tears down cleanly via TaskStop once the run is green.
2. Loop on CICD NeMo until green — quarantine real flakes by git mv-ing launch scripts into the matching flaky/ dir, append them to the PR body's "Quarantined tests" section, repeat.

While writing the skill I confidently propagated a wrong claim — that L2 is schedule-only. Reading .github/workflows/cicd-main.yml shows EXPECT_L2=true is also set when FULL_TEST_SUITE=true, i.e. when the PR carries the full-test-suite label (line 152). Fixed everywhere it was wrong.

Files touched

• skills/bump-dependency/SKILL.md — new skill, full-test-suite recommended for high-blast-radius bumps; trimmed against cross-referenced skills.
• skills/testing/SKILL.md — Tier Semantics table updated.
• skills/cicd/SKILL.md — pipeline tree updated.
• CONTRIBUTING.md — Tier table, Risk Labels table, and PR labeling checklist all gained full-test-suite.
• .github/workflows/cicd-main.yml — comment above cicd-functional-tests-l2 corrected (no behavioural change).

Test plan

• Skill renders cleanly in the GitHub UI
• Cross-references resolve (@CONTRIBUTING.md, @skills/build-and-dependency/SKILL.md, @skills/cicd/SKILL.md, @skills/testing/SKILL.md)
• No .py files touched → no functional CI required (docs-only label)

[claude]

Light Code Review

Docs-only PR adding skills/bump-dependency/SKILL.md. Cross-references (@CONTRIBUTING.md, @skills/build-and-dependency/SKILL.md, @skills/cicd/SKILL.md, @skills/testing/SKILL.md) all resolve. The active/flaky directory layout, override-dependencies pattern, and needs-more-tests label semantics match the repo.

Minor issue — Nested code fences in Step 4 (lines 100-130): The PR body template contains triple-backtick code fences (lines 109-111, the Lockfile delta block) inside an outer bash fence. When rendered by GitHub markdown parser, the inner backticks close the outer fence prematurely, causing the rest of the block (the gh pr create command) to render as regular text. Fix: use four backticks for the outer fence, or indent the heredoc body so the inner backticks are not at the same nesting level.

Everything else looks good - the watchdog script logic is correct, the pitfalls table is accurate, and the anti-patterns section is well-motivated.

Suggested test cases: No perf tests impacted.

[chtruong814]

may want to prefix this with repo as well to avoid potential clash?