feat: register NeMo Fabric skills

[exactlyallan]

Onboarding type

• New product onboarding (new components.d/<slug>.yml file)
• Other (catalog change, README fix, infrastructure, etc.)

For new product onboarding — author affirmations

By submitting this PR, I confirm on behalf of my team:

• Skills cleared for open source release per NVIDIA's internal IP review process (six-question check, all answers affirmative) — pending product-team confirmation
• License selected: Apache 2.0 / CC-BY 4.0 / Dual (Apache 2.0 + CC-BY 4.0). Specify: Apache 2.0
• No new license or new third-party component introduced beyond what the source repo already carries
• Source repo is public and under an NVIDIA-owned GitHub org
• .agents/skills/ or skills/ path used for new entries (or existing path retained for legacy entries per components.d/<slug>.yml)

Summary

Registers the two portable, public NeMo Fabric integration skills:

• nemo-fabric-integrate for consumer applications using the typed Python SDK
• nemo-fabric-build-adapter for third-party adapter authors using the public adapter contract

The source bundles are in NVIDIA/NeMo-Fabric at skills/, include their signature, skill card, and evaluation assets, and are intentionally distinct from its repository-internal maintainer skill set.

Validation

• Parsed the component manifest and verified its exact two source-to-catalog mappings.
• Verified both source paths and required catalog artifacts at NeMo Fabric main commit b73bbb1a4dd1a31214723ce339dc167f3b7e4b31.
• Confirmed catalog-directory names are unique and ran git diff --check.

Reviewer checklist (OSS Skills PIC)

• Author confirmations above are checked
• components.d/<slug>.yml entry valid (required fields, unique catalog_dir, path exists in source repo, filename slug matches name)
• SKILL.md frontmatter spec-compliant (at least one sampled)
• No new license or third-party dependency requiring OSRB filing

All PRs

• All commits signed off with DCO (git commit -s).

[mosheabr]

Reviewed. Manifest, layout, and artifacts all check out:

• nemo-fabric.yml slug, required fields, flat one-entry-per-skill layout, product-prefixed names — all correct. catalog_dir values are unique against all 334 existing entries. links.discussions: false matches the source repo; CONTRIBUTING.md and SECURITY.md exist so the defaults resolve.
• Both skills carry SKILL.md, skill.oms.sig, skill-card.md, evals/evals.json, and a BENCHMARK.md showing Overall verdict: PASS with real Tier 3 results.
• I re-verified the signatures independently given the publication blocker noted in NeMo-Fabric#232: every file digest in both manifests recomputes exactly against main at b73bbb1a, no files in either directory are left uncovered, both DSSE envelopes verify against the leaf key, and the chain matches the NVIDIA signing anchors. No drift — that blocker was resolved before merge.
• Nice separation of the 14 maintainer skills into .agents/skills/ — only the 2 portable skills are exposed.

One item before I can approve: affirmation #1 (IP review) is unchecked, marked pending product-team confirmation. Since both skills are already public in NeMo-Fabric, this should be a matter of confirming the six-question check was affirmative at the source merge rather than running anything new. Please tick the box and note who confirmed, and I'll approve.

Two non-blocking things worth a look when you next regenerate:

1. nemo-fabric-build-adapter shows Claude Code Security going 100% → 75% (-25 points) with the skill applied. It still clears the pass band, but a skill that lowers a security score is worth understanding.
2. nemo-fabric-build-adapter/SKILL.md has no license: field and no metadata.author, both flagged in Tier 1; its sibling declares license: Apache-2.0. Worth aligning, though since it needs a re-sign it's better batched with other changes than done on its own.

[exactlyallan]

One item before I can approve: affirmation #1 (IP review) is unchecked, marked pending product-team confirmation. Since both skills are already public in NeMo-Fabric, this should be a matter of confirming the six-question check was affirmative at the source merge rather than running anything new. Please tick the box and note who confirmed, and I'll approve.

Affirmed!

[mosheabr]

Affirmation #1 confirmed by @exactlyallan directly (box ticked, affirmed in-thread). All checklist items verified per my review above; the two non-blocking items are noted for the next regeneration. Approving.