fix: preserve safety sections in Skill distillation

[kriptoburak]

Summary

Preserve request workflows and safety controls during Skill-to-GEP parsing.
The defect surfaced against the public Xquik X Twitter Scraper Skill.

What changed

• Recognize request-process headings as workflow sections.
• Preserve credential, approval, safety, and trust-boundary sections.
• Add a self-contained API Skill regression fixture.
• Keep the existing 28-step strategy cap unchanged.

Before this change, the sample shape produced only workflow examples. It
dropped the ordered request process and every safety section. After this
change, the same shape keeps both the process and its guardrails.

How to test

1. Run node --test test/skill2gepParser.test.js.
2. Run node --test test/skill2gep.test.js test/skill2gepParser.test.js test/skill2recipes.test.js.
3. Run npm test.
4. Run node index.js --help.

Expected results:

• Parser suite: 24 passed, 0 failed.
• Focused Skill suites: 52 passed, 0 failed.
• Full suite: 3,290 passed, 0 failed.
• CLI help exits successfully.

Risk

Medium. New Genes may contain more source Skill rules. Existing assets,
schemas, network behavior, and the 28-step cap remain unchanged.

Harness/evaluator governance

Upstream governance surface: src/gep/skill2gep.js heading selection for reverse-distilled Gene strategies.
Downstream EvoX impact: New reverse distillations preserve additional source rules; schemas and bridge contracts stay unchanged.
Rollout-local scope: The change affects newly parsed local Skills only; existing assets remain unchanged.
Promotion boundary: Merge enables parsing; existing review, publication, and promotion gates remain separate.
Evaluator mismatch sets: Observation recognizes more headings; action retains their list items; repair adds aliases; verification covers parser and full-suite behavior; evidence includes a live public Skill probe; belief logic is unchanged.
Non-regression evidence: 24 parser tests, 52 focused Skill tests, 3,290 full-suite tests, CLI sanity, and a live public Xquik Skill parse.
Fix-severity review: medium
Owner approval: Skill-to-GEP parser owner review required.
Security boundary: No new data, tool, host, network, or secret access. Credential and untrusted-content rules are retained instead of dropped.
Rollback: Revert this commit. Existing assets require no migration.
Live promotion: no
Autonomous evaluator self-editing: no

Self-check

• No new runtime dependencies added.
• Tests cover the new behavior and the full suite passes.

Related

No existing issue or pull request covers this parser gap.