fix(openehr-specs): build publish previews only through the published image

[sebastian-iancu]

Follow-up to #4, which is merged. Its commits are in main, so this PR shows only the one commit on top.

Summary

The local-script branch of the publish skill ran spec_publish.sh -f -v without -q. BASE's master.adoc sets {pkg} only under ifdef::package_qualifiers[], so every class-table include failed, and the script still printed generated <file> and exited 0.

I measured this on BASE with the published image:

Run	Flags	Errors	base_types.html	Table blocks (base_types)
Image entrypoint	-f -r -v -t -q -l	0 (one INFO)	151 KB	890
Control, same image	-f -v (what the script branch ran)	70 include file not found … {pkg}…	72 KB	140

Both runs exited 0 and printed four generated lines, so the timestamp check added in #4 would have called the broken output "rebuilt". The published ghcr.io/openehr/asciidoctor image passes -q in its entrypoint, so this PR removes the script branch.

Changes

• publish runs only the image. It checks for Docker and the sibling specifications-AA_GLOBAL checkout, snapshots the HTML timestamps, builds with --rm, then fails the build on a missing or unchanged output or on any ERROR or include file not found log line (an INFO line is not a failure). The which asciidoctor jq bc pre-check and the script's allowed-tools rule are gone, so its only Bash rule is docker run * ghcr.io/openehr/asciidoctor *.
• The AA_GLOBAL checkout is still required. The image bundles the toolchain and spec_publish.sh, but ref_dir is $pub_home/specifications-AA_GLOBAL and pub_home defaults to $PWD, so the boilerplate and reference_definitions.adoc are read from the mounted checkout.
• authoring step 7 shows the image first and says to pass -q with a local toolchain.
• AGENTS.md, the plugin README, docs/testing.md and the CHANGELOG match. The Unreleased entries from refactor(openehr-specs): move commands to user-only skills, fold amend into amendment-record #4 are updated in place; nothing is released.

For reviewers

• Trade-offs of image-only. The image is 2.28 GB, and its entrypoint forces -r (remote CSS, so it needs network and cannot preview local CSS changes) and -l development. The script inside the image can lag the clone's bin/, because the publish workflow is manual and the base image is :latest.
• BASE's own AGENTS.md still gives specifications-AA_GLOBAL/bin/spec_publish.sh BASE as the render command. That omits -q, so it hits the same 70 errors. It is outside this repo and I did not change it.
• Not covered: the amendment-record placement bug (the skill says to insert at the top of the table, but 39 of 45 amendment records open with a release row) and the regen-classes bundled-schema issue remain follow-ups.

Checklist

• python3 scripts/validate.py passes (also claude plugin validate plugins/openehr-specs --strict)
• Skill triggering tested locally in Claude Code (see docs/testing.md) — partly: I ran the exact docker run command and the snapshot, verify and restore steps by hand against BASE, but not through a live /openehr-specs:publish invocation, and the allowed-tools pattern was not exercised in a session
• Cursor install tested locally when plugin or manifest content changed (see docs/install.md) — not done
• Both marketplaces updated when plugin metadata changed (n/a: no manifest or version change)
• CHANGELOG.md updated under Unreleased; no version bump
• Content grounded in published openEHR specifications — no invented identifiers (behaviour measured on BASE; entrypoint and checkout requirement read from specifications-AA_GLOBAL/Dockerfile, bin/spec_publish.sh and its AGENTS.md)

🤖 Generated with Claude Code