fix push-to-action: use CLI direct invocation for token acquisition

the inline `node -e` + `TOKEN=$(...)` approach broke because
`core.getIDToken()` in @actions/core writes `::debug::` and
`::add-mask::` to stdout, polluting the captured value.

`node cli.ts gha token` uses `core.setOutput()` which writes to
the $GITHUB_OUTPUT file instead of stdout.

Made-with: Cursor

utils/skills.ts

@@ -1,6 +1,9 @@
 import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
 import { log } from "./cli.ts";
 
+const skillsBin = resolve(import.meta.dirname, "../node_modules/.bin/skills");
+
 export function addSkill(params: {
   ref: string;
   skill: string;
@@ -8,8 +11,8 @@ export function addSkill(params: {
   agent: string;
 }): void {
   const result = spawnSync(
-    "npx",
-    ["skills", "add", params.ref, "--skill", params.skill, "-g", "-a", params.agent, "-y"],
+    skillsBin,
+    ["add", params.ref, "--skill", params.skill, "-g", "-a", params.agent, "-y"],
     {
       env: { ...process.env, ...params.env },
       stdio: "pipe",

utils/token.ts

@@ -6,7 +6,7 @@ import { onExitSignal } from "./exitHandler.ts";
 import { acquireNewToken } from "./github.ts";
 import { isGitHubActions } from "./globals.ts";
 
-// re-export for get-installation-token action
+// re-export for `pullfrog gha token` subcommand
 export { acquireNewToken as acquireInstallationToken };
 export { revokeGitHubInstallationToken as revokeInstallationToken };