Extract /deploy bump-verify-push sequence into bump-and-tag.py

[sebastientaggart]

Extract the bump-verify-push sequence from /deploy Step 3 into skills/github-agile/scripts/bump-and-tag.py, following the #163 pattern. The script runs the project's bump command, re-reads the version via --version-read-cmd, verifies that vX.Y.Z was created (creating an annotated fallback when tag.forceSignAnnotated silently rejected a lightweight tag), and pushes both the commit and the tag atomically. The resolved version is printed on stdout so the calling skill can capture it for the release step.

deploy.md Step 3 collapses from ~20 lines of narrated shell into a single python3 …/bump-and-tag.py … invocation per bump variant. The skill remains agnostic to whether the project uses Make, npm, uv, or a custom script — the bump and version-read commands are passed as opaque shell strings via the existing {{BUMP_*_CMD}} / {{VERSION_READ_CMD}} template variables.

Issue #152

[sebastientaggart]

Review Summary

Verdict: APPROVE

Findings

• [NOTE] The bump-and-tag.py script consistently matches the docstring/exit-code/stderr-diagnostic style of sibling scripts (post-issue-comment.py, sync-base-branch.py), and the bump → verify → annotated-fallback → push sequence faithfully mirrors the prior inlined shell in /deploy Step 3.
• [NOTE] Using subprocess.run(..., shell=True) for the user-supplied --bump-cmd / --version-read-cmd is appropriate here because the skill explicitly passes opaque project-template shell strings; the script's docstring documents this contract.
• [NOTE] The pre-existing typo make set-version V= 2.4.5 (stray space after V=) carries over unchanged in the deploy markdown table; it is not introduced by this PR and is out of scope, but worth fixing in a follow-up.

No correctness, security, or convention issues found. The skill markdown collapse is consistent across all four adapters and the source template, and the generated-file hashes were refreshed via sync.

[sebastientaggart]

Review Summary (re-review of commit 45840a1)

Verdict: APPROVE

The follow-up commit correctly addresses the prior NOTE finding about the stray-space rendering bug. The source template at skills/github-agile/deploy.md now uses {{SET_VERSION_CMD}}2.4.5 (no space), which, given .codecannon.yaml's SET_VERSION_CMD: "make set-version V=", renders as make set-version V=2.4.5 across all four adapter outputs (.claude/commands/deploy.md, .agents/skills/deploy/SKILL.md, .cursor/rules/deploy.mdc, .gemini/skills/deploy/SKILL.md). The convention shift — SET_VERSION_CMD carries its own trailing separator (= for kwarg style, trailing space for positional like "npm version ") — is applied uniformly. The first commit's bump-and-tag.py extraction and the Step 3 rewrite still hold; nothing else regressed.

Findings

• [NOTE] The trailing-separator convention for SET_VERSION_CMD is implicit in the template and only discoverable by reading the rendered output; a one-line comment near the variable in the skill template or in .codecannon.yaml's default would make the contract explicit for downstream projects configuring their own value.

[sebastientaggart]

Review Summary

Verdict: APPROVE

Findings

No issues found. The trailing-separator convention for SET_VERSION_CMD is now documented consistently in templates/codecannon.yaml, .codecannon.yaml, and docs/customization.md. The wording is clear, gives both the kwarg-style (=) and positional (trailing space, npm version ) examples, and the inline YAML comments match the prose in the docs. No code changes in this commit; previous approvals stand.