Summary

• replace the PR-gate workflow runtime from downloaded skill-validator binaries to @microsoft/vally-cli lint
• keep the same PR artifact/comment flow (summary tables, severity counts, and managed labels)
• update the PR-comment and workflow-run wiring to the new Vally workflow names/artifact
• migrate nightly skill quality reporting to Vally output and keep agent visibility as explicit scan notes

Behavior details

• PR gate still detects both changed skills and agents.
• Changed skills are linted with npx --yes @microsoft/vally-cli lint <skill> --verbose.
• Agent files are currently reported as detected-but-skipped in output so scope accounting remains visible.
• The check remains warn-only at workflow level, with findings captured in the PR comment/artifacts.

Validation

• npm run plugin:validate
• npm run build
• npm run skill:validate