chore(repo): establish project baseline

Track the source-of-truth code, skills, bootstrap rules, docs, and packaging files before adding new features.

Exclude local vault config, generated skill mirrors, temporary exports, virtual environments, and business data files from version control.

Validation: inspected staged file list and git ignored status before commit.

.github/workflows/publish.yml

@@ -0,0 +1,65 @@
+name: publish
+
+# Build and publish obsidian-wiki to PyPI when a version tag is pushed.
+#
+# Setup (one-time): on PyPI, add a Trusted Publisher for this repo with
+# workflow `publish.yml` and environment `pypi`. No API token needed — the
+# `id-token: write` permission below mints a short-lived OIDC credential.
+#
+# Release: bump `version` in pyproject.toml, commit, then
+#   git tag v0.1.0 && git push origin v0.1.0
+
+on:
+  push:
+    tags:
+      - "v*"
+  # Allow a manual build (artifacts only, no publish) for verification.
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+      - name: Build sdist and wheel
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+      - name: Verify wheel bundles the skills
+        run: |
+          python -m pip install --upgrade twine
+          twine check dist/*
+          wheel=$(ls dist/*.whl)
+          echo "Inspecting $wheel"
+          if ! python -m zipfile -l "$wheel" | grep -q "obsidian_wiki/_data/skills/wiki-setup/SKILL.md"; then
+            echo "::error::wheel is missing bundled skills under obsidian_wiki/_data/skills/"
+            exit 1
+          fi
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    # Only publish on a real tag push, not workflow_dispatch.
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    environment: pypi
+    permissions:
+      id-token: write  # required for PyPI Trusted Publishing (OIDC)
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true

.github/workflows/setup.yml

@@ -0,0 +1,29 @@
+name: setup
+
+# Guards setup.sh against the regression where it rewrites committed
+# relative symlinks with absolute paths (or any other modification to
+# tracked files). See #52 for the original bug.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  install-leaves-tree-clean:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run setup.sh
+        # stdin closed so the vault-path prompt returns empty rather than hang
+        run: bash setup.sh < /dev/null
+      - name: Working tree must be unchanged
+        run: |
+          if ! git diff --exit-code; then
+            echo "::error::setup.sh modified tracked files. Likely cause: an" \
+                 "in-repo symlink mirror is being written with an absolute" \
+                 "target instead of a relative one. See install_skills() in setup.sh."
+            exit 1
+          fi
+      - name: Re-run is idempotent
+        run: bash setup.sh < /dev/null && git diff --exit-code