feat: add Canvas Extensions API app-building skill

[DevinVinson]

• A human has tested these changes.
  I've been using and updating this skill to build apps in the canvas-apps repo. The sidecar pattern is the newest addition and the agent seems to make good use. One thing that helps is if you also have a react best practices skill and/or something for vite but the skill itself provides enough guidance without that.

---

Why

Agent Canvas users currently need to install an external skill before an agent can build Apps for Agent Canvas. This adds the existing app-authoring guidance to the public extensions registry and aligns it with the current manifest schema 1 and host API 1 routed-page contract.

Summary

• Add the self-contained canvas-extension-api skill, supporting references, and dependency-free validator tests.
• Register the skill as an opt-in agent-authoring extension and regenerate the built-in catalog artifacts.
• Verify the documented contract against current OpenHands Canvas types, runtime, routing, service behavior, and TypeScript client exports.

Issue Number

Fixes #588

How to Test

node --test skills/canvas-extension-api/scripts/validate-extension.test.mjs
node skills/canvas-extension-api/scripts/validate-extension.mjs /path/to/canvas-app
uv run pytest -q tests/test_catalog_schema.py tests/test_catalogs.py tests/test_skills_catalog.py tests/test_skills_have_readme.py tests/test_sync_extensions.py tests/test_skill_plugin_loading.py
python scripts/sync_extensions.py --check

Expected results:

• The validator unit test passes.
• A representative valid Canvas app reports Canvas App validation passed.
• The repository test selection reports 260 passing tests.
• The sync check passes. It may print the pre-existing non-blocking coverage warning for plugins/issue-duplicate-checker.
• canvas-extension-api appears in marketplaces/openhands-extensions.json, README.md, and skills/index.js without defaultEnabled.

Video/Screenshots

Not applicable - this change adds a skill and validation tooling, with no application UI changes.

Notes

• The validator remains internal to the skill because it enforces this skill-specific package guidance and has no existing shared consumer.
• The skill intentionally documents routed pages as the only supported host API 1 contribution.

This pull request was created by an AI agent (OpenHands) on behalf of Devin Vinson.

[all-hands-bot]

👋 This PR needs a couple of things fixed before OpenHands can review it:

• the PR description's HUMAN: section needs at least 20 characters describing what you tested, not just the template placeholder

Push an update once this is addressed and this check re-runs automatically.

This is an automated check - no AI was used to generate this comment.