refactor: sharpen template scaffolding rules for skill conflict detection

The original three never entries surfaced false-positive conflicts with
plugin setup instructions during integration testing against the
databricks-apps skill (Track B PR databricks/databricks-agent-skills#79):

- 'Modify files inside the template directory' caught every plugin must
  rule that edits scaffolded files (genie spaces config, lakebase
  migrations, analytics queries). The rule was either unreachable (if
  read as the SDK source-of-truth) or contradictory (if read as the
  scaffolded output, which the user owns post-init). Deleted.
- 'Hardcode workspace-specific values in template files' conflated
  workspace IDs (which are correctly committed to bundle config) with
  credentials (which must not be). Replaced with a must/never pair that
  names the legitimate destinations (app.yaml, databricks.yml, .env)
  and the leak path (client bundle).
- 'Skip resource configuration prompts' conflicted with the --set
  non-interactive path. Replaced with a should/never pair covering the
  actual decision-time failures: ask the user when uncertain; never
  guess when discovery returns zero or multiple options.

Net: 0 must + 0 should + 3 never -> 1 must + 1 should + 2 never. All
entries describe agent behaviors at decision points (substitutability
gate passes), each under 120 chars, and the merged set is precedence-
and phase-clean per the skill PR's protocol.

Regression test in validate-manifest.test.ts updated to pin the new
contents.

Co-authored-by: Isaac
Signed-off-by: Atila Fassina <atila@fassina.eu>

Author: atilafassina

packages/shared/src/cli/commands/plugin/validate/validate-manifest.test.ts

@@ -970,12 +970,24 @@ describe("validate-manifest", () => {
       // because each was substitutable: skill content (1), derivable from
       // `requiredByTemplate` field (2), derivable from `field.env` enumeration
       // (3), or a discovery-descriptor concern (4 — A6 candidate (a)).
-      expect(TEMPLATE_SCAFFOLDING.rules.must).toHaveLength(0);
-      expect(TEMPLATE_SCAFFOLDING.rules.should).toHaveLength(0);
+      //
+      // The post-Track-B-design pass replaced the remaining never entries with
+      // rules sharper against the conflict-detection step in databricks-apps
+      // skill 0.1.2 (Track B PR #79). The original "Modify files inside the
+      // template directory" rule conflicted with plugin setup instructions
+      // that legitimately edit scaffolded files; "Hardcode workspace-specific
+      // values" was reframed around credentials and runtime targets; "Skip
+      // resource configuration prompts" was split into a should/never pair
+      // covering the actual decision-time failures.
+      expect(TEMPLATE_SCAFFOLDING.rules.must).toEqual([
+        "Keep all secrets and credentials only in app.yaml, databricks.yml, and/or .env",
+      ]);
+      expect(TEMPLATE_SCAFFOLDING.rules.should).toEqual([
+        "ask user when in doubt of resource to use for plugin",
+      ]);
       expect(TEMPLATE_SCAFFOLDING.rules.never).toEqual([
-        "Modify files inside the template directory",
-        "Skip resource configuration prompts",
-        "Hardcode workspace-specific values in template files",
+        "guess resources when multiple or no options are available",
+        "embed secrets in files that will go to the client-bundle",
       ]);
     });
   });

packages/shared/src/schemas/manifest.ts

@@ -1062,12 +1062,13 @@ export const TEMPLATE_SCAFFOLDING = {
     },
   },
   rules: {
-    must: [],
-    should: [],
+    must: [
+      "Keep all secrets and credentials only in app.yaml, databricks.yml, and/or .env",
+    ],
+    should: ["ask user when in doubt of resource to use for plugin"],
     never: [
-      "Modify files inside the template directory",
-      "Skip resource configuration prompts",
-      "Hardcode workspace-specific values in template files",
+      "guess resources when multiple or no options are available",
+      "embed secrets in files that will go to the client-bundle",
     ],
   },
 } satisfies z.infer<typeof scaffoldingDescriptorSchema>;