…ne skill, honest run signal (#4258)

Harden Skia upstream-sync: conflict policy, durable gn args, standalone skill, honest run signal (#4258)

Follow-up to the mode=main tip work (#4254) and release-line targeting
(#4239). The first real tip runs exposed three rough edges in the
auto-skia-sync automation, plus that key Skia-update knowledge lived only
in the workflow prompt where the update-skia skill couldn't reach it.

~~ Verify-upstream-or-reapply conflict resolution ~~

A tip merge runs ~291 commits ahead of our submodule base and conflicts on
every file carrying an [M1xx] fork cherry-pick. The old "keep ours / resolve
what you reasonably can" guidance risked silently dropping a not-yet-
upstreamed patch (--theirs) or freezing a stale form of one upstream had
since refined (--ours; e.g. our SDF-LCD patch used getMaxScale() while
upstream relanded it as sk_ieee_float_divide(1.f, getMinScale())).

Replace it with an explicit, auditable policy: classify each fork patch on a
conflicted file as upstreamed (take upstream's form, record the SHA) or not
upstreamed (re-apply ours on top) -- never a blanket --theirs/--ours, never
a silent drop. A mandatory before-merge fork-patch snapshot is cross-checked
so every patch lands in the resolution table as upstreamed or re-applied; a
patch that is neither is a lost patch -> stop and fix. Applied across gotcha
#15, SKILL.md Phase 5, and the workflow tip note.

~~ Allow a required new gn arg through build.cake ~~

The tip build needed skia_use_partition_alloc=false because upstream now
defaults it to is_clang while our DEPS deliberately omits partition_alloc;
Skia ships an official zero-overhead noop raw_ptr for exactly this case, so
=false is the supported embedder path, not a hack. The rule banned all
build.cake edits, forcing a one-off --gnArgs CLI flag and leaving durable
config non-durable.

Split the rule into two tiers: still forbid changing compiler/linker flags
(or scripts/infra/native/**) to silence a host build error, but allow adding
a genuinely required new upstream gn arg to the affected platforms'
native/**/build.cake gn-args lists, flagged in both PR summaries for cross-
platform review. Sequencing is honored: the toggle doesn't exist in m150, so
the relaxed rule lets the next milestone merge add it in-context rather than
breaking the current build. Recommendation for the eventual bump (gotcha #23):
keep partition_alloc disabled via the supported noop, not by vendoring the
Chromium allocator.

~~ Make the skill standalone; reduce the workflow to CI overrides ~~

main/tip mode and the required-new-gn-arg rule were documented only in the
workflow prompt, so the update-skia skill couldn't drive them locally. Move
both into the skill: tip mode becomes a first-class third option in Phase 1
(new {UPSTREAM_REF} variable, merge-base..upstream/main milestone diffs,
generalized Phase 5 merge command), and the gn-arg rule lands in Phase 7
backed by gotcha #23. Trim the workflow's duplicated build.cake/mode prose to
short pointers, keeping only genuinely CI-specific guardrails (can't apt-
install in the sandbox; a missing host dep is a workflow bug, not a flag hack;
Linux-only-build cross-platform review). These are prompt-body edits, so the
lock stays byte-identical.

~~ Stop mislabeling a real sync as a no-op ~~

A sync that merged upstream, built, tested, and opened both PRs was reported
by the gh-aw conclusion job as a no-op, which then failed trying to file a
no-op issue (the workflow has no issues: write). Cause: safe-outputs staged
mode blocks the agent from creating anything directly -- the real PRs are
opened by the host post-step skia-sync-push-prs.sh with the autobump token --
so noop was the agent's only completion signal and every run, real or not,
signalled noop.

Give the agent an honest signal: declare create-pull-request in safe-outputs,
kept staged (preview-only; the safe_outputs job is ubuntu-slim with
permissions:{} and never touches the workspace) so a real sync registers as a
pull-request output, while real PRs still come only from the post-step. Set
noop: report-as-issue: false so noop is reserved for genuine no-work runs and
no longer files an uncreatable issue; drop the unused create_issue offer; and
add a "Completion signal" section to the prompt. This is the one frontmatter
edit in the PR, so auto-skia-sync.lock.yml is regenerated.

Validated end-to-end by run 28269474099 (mode=main, real 2-commit merge): the
agent emitted a staged create_pull_request, the conclusion logged no noop with
no failed issue step, and the post-step still pushed skia-sync/main to both
repos and updated the real PRs (#4263 + #269). Rebased on main to pick up the
#4260 workflow rename (lock recompiled to a 0-diff) and confirm consistency
with the #4267 support-status model.

Co-authored-by: Matthew Leibowitz <mattleibow@live.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>