feat: add Canvas Extensions API app-building skill

Summary

Port the existing canvas-extension-api skill into this repository so a fresh Agent Canvas installation can use it to build Apps for Agent Canvas without first installing an external skill.

The skill teaches agents how to create, package, validate, install, and verify Canvas extension packages that use the currently implemented schema v1 / host API v1 routed-page contract.

Source material

• Source directory: skills/canvas-extension-api
• Primary instruction file: SKILL.md
• Supporting references: v1 contract, packaging recipes, testing and installation, backend safety, sidecar pattern, connections, and acceptance checklist
• Reusable Node validator and its tests: scripts/validate-extension.mjs and scripts/validate-extension.test.mjs

Proposed implementation

1. Copy the source skill into the repository’s canonical skills location, preserving its directory structure and relative links.
2. Review and update SKILL.md for current OpenHands terminology and upstream behavior before merging. Validate its claims against the relevant upstream Canvas implementation/specification, including manifest schema, activate(host), host.registerPage, agent-server request boundaries, routing, and installation.
3. Keep the skill self-contained: references and validator scripts must resolve from the installed skill directory, with no machine-specific absolute paths in committed instructions.
4. Retain validator coverage and add or adjust repository-appropriate checks so the copied validator and referenced files are present and executable.
5. Confirm the frontmatter follows this repository’s discovery/trigger conventions and does not duplicate or conflict with an existing skill.
6. Add any required registry, index, catalog, or documentation entry used to surface built-in skills in a new Canvas installation. Do not invent registration if none is required; document verification that established the correct behavior.

Desired Behavior

A fresh Agent Canvas installation can discover a built-in skill that guides agents through creating, packaging, validating, installing, and verifying Apps for Agent Canvas against the supported manifest schema 1 and host API 1 routed-page contract.

Acceptance Criteria

• skills/canvas-extension-api/SKILL.md (or the equivalent canonical location) is included with valid frontmatter and working trigger language.
• All required references and scripts/validate-extension.mjs are included; every relative SKILL.md reference resolves after a normal checkout/install.
• Validator tests pass using the repository-supported Node test command, or an equivalent targeted command is documented in the PR.
• The skill accurately describes only the supported Canvas Extensions API v1 surface; stale or planned APIs are removed or clearly excluded.
• A fresh installation exposes the skill through normal built-in discovery, without users adding DevinVinson/skills separately.
• The PR documents exact verification: skill discovery, validator test, and a representative Canvas extension package validation.

Non-goals

• Building or publishing a sample Canvas app.
• Changing the Canvas Extensions API or Agent Canvas runtime.
• Automatically enabling or installing any Canvas app.

Open questions

• Should the validator remain internal to this skill or be promoted to a shared extensions utility if another consumer already exists?
• Does this repository require an explicit catalog/index update for built-in skills, or is adding the skill directory sufficient?
• Are there recent Canvas API naming or behavior changes that should be incorporated while porting?

This issue was created by an AI agent (OpenHands) on behalf of the user.

Start by comparing the source skills/canvas-extension-api directory and its SKILL.md with this repository’s canonical skills location, including the listed references and scripts/validate-extension.mjs with scripts/validate-extension.test.mjs. Check the repository’s discovery or catalog entry points and supported Node test command before porting. Done means all relative references resolve, validator tests pass, supported API v1 behavior is documented, and a fresh installation exposes the skill.