ci: adopt devkit e2e (fork)

.devkit.yml

@@ -0,0 +1,3 @@
+# Fork kept in sync with upstream — declare the source dir (DEC-043).
+plugin_dir: .
+display_name: "Phantom Bridge"

.github/workflows/devkit-sync.yml

@@ -0,0 +1,33 @@
+# devkit-sync — caller template (SPEC DEC-044).
+#
+# Copied into a consumer plugin repo at .github/workflows/devkit-sync.yml by
+# `make link-workflows`. Keeps the repo's vendored devkit submodule
+# (tests/_testkit) current by bumping it to the devkit's latest main nightly.
+#
+# Required REPO-level secrets (the shared sync GitHub App; already present on
+# repos that previously used skills-sync — same App):
+#   SKILLS_SYNC_APP_CLIENT_ID    — App OAuth Client ID (Iv23li…)
+#   SKILLS_SYNC_APP_PRIVATE_KEY  — App private-key PEM
+# The App must be installed (Contents:Read) on the devkit repo. It does NOT
+# need to be installed on this consumer — GITHUB_TOKEN covers the local push/PR.
+#
+# DO NOT add pull_request: triggers — fork-PR is the secret-exfiltration vector.
+name: devkit-sync
+
+on:
+  schedule:
+    - cron: "0 4 * * *"   # nightly 04:00 UTC (offset from skills-sync's 03:00)
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  sync:
+    uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/devkit-sync.yml@main
+    with:
+      devkit-submodule-path: "tests/_testkit"
+    secrets:
+      SKILLS_SYNC_APP_CLIENT_ID: ${{ secrets.SKILLS_SYNC_APP_CLIENT_ID }}
+      SKILLS_SYNC_APP_PRIVATE_KEY: ${{ secrets.SKILLS_SYNC_APP_PRIVATE_KEY }}

.github/workflows/plugin-e2e.yml

@@ -0,0 +1,24 @@
+# plugin-e2e — caller template (SPEC DEC-020/044).
+#
+# Copied into a consumer plugin repo at .github/workflows/plugin-e2e.yml by
+# `make link-workflows`. Runs the full install → verify-installed → uninstall →
+# verify-uninstalled lifecycle (A0 booted nested + rootless) on every PR.
+#
+# Parameter-free: the reusable workflow resolves the plugin from the repo
+# (.devkit.yml `plugin_dir` → else canonical usr/plugins/<name>), so this
+# template is identical across all repos.
+#
+# Needs the shared sync-App secrets to clone the private devkit submodule.
+name: plugin-e2e
+
+on:
+  pull_request:
+    branches: ["main", "master"]
+  workflow_dispatch:
+
+jobs:
+  e2e:
+    uses: agent-zero-plugins/agent-zero-plugin-development-testkit/.github/workflows/plugin-e2e.yml@main
+    secrets:
+      SKILLS_SYNC_APP_CLIENT_ID: ${{ secrets.SKILLS_SYNC_APP_CLIENT_ID }}
+      SKILLS_SYNC_APP_PRIVATE_KEY: ${{ secrets.SKILLS_SYNC_APP_PRIVATE_KEY }}

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "tests/_testkit"]
+	path = tests/_testkit
+	url = https://github.com/agent-zero-plugins/agent-zero-plugin-development-testkit.git