Validated publish (the write engine; spec §5.4 made real). Runs the required checks ('CI'), auto-bumps the semver version from the projection's current latest (GitVersion-style: default patch; +semver: minor|major in message overrides, or an explicit bump), and emits a skill.published event (which folds into the projection). Body: {files:[{path, content|content_b64}], bump?, message?, set_latest?} Returns 201 {version, ...} or 422 {checks:[...]} on a failed check.

Surface note: this is the engine every write path drives; the git push (gitflow) surface is a later increment that validates + calls this same core.