feat(bg_remover): harden skill to v0.2.0

[AyushSrivastava1818]

Description

Hardens the creative/bg_remover skill to v0.2.0 by improving robustness, validation, and documentation.

Fixes #257

Changes

• Reuse cached rembg sessions across executions.
• Validate Base64 input and image files.
• Reject missing, directory, empty, oversized (>25 MB), and invalid image inputs.
• Automatically create parent directories for output_path.
• Update the skill documentation and manifest.
• Expand test coverage for the new validation behavior and session reuse.

Type of Change

• Skill Upgrade — changes to an existing skill under skills/

Checklist (all PRs)

• Linked GitHub issue (Fixes #257)
• Scope matches the issue — no unrelated refactors
• python -m black --check . and flake8 pass locally (or CI-equivalent subset)
• pytest skills/ and pytest tests/ pass locally when relevant
• CHANGELOG.md updated under [Unreleased] when user-visible behavior changes
• examples/README.md updated if this PR adds, renames, or removes a runnable script
• Ran pytest tests/test_registry_docs.py when skills, examples index, or agent-loops matrix changed

New or updated skill

• Skill at skills/<category>/<skill_name>/ (from templates/python_skill/ or equivalent)
• manifest.yaml: name, version, description, parameters, constitution, real issuer
• Deterministic skill.py (no ad-hoc LLM-generated execution paths)
• instructions.md explains when and how to use the skill
• card.json issuer matches manifest when present
• test_skill.py covers execution and schema expectations
• SkillLoader.load_skill("/<skill_name>") succeeds (or deps documented)
• docs/skills/README.md and row in docs/skills/README.md
• Usage Examples for Gemini, Claude, OpenAI, DeepSeek, Ollama per skill usage template

Constitution and safety

This update improves input validation and filesystem safety by validating Base64 input and image files, rejecting missing, directory, empty, oversized (>25 MB), and invalid images, reusing cached rembg sessions, and automatically creating parent directories for output_path.

Related Issues

Fixes #257

[rosspeili]

Thanks for the clean branch, much better than #266, I will close 266 and track here.

This is closer on the runtime core (session cache, basic validation, 25 MB limit, mkdir for output_path, tests), but it is not yet enough to close #257. Please treat the issue acceptance criteria as a checklist and finish them in this PR.

Still missing / fix

1. Rebase on current main (post-0.4.7 / citation) so CHANGELOG/Unreleased merges cleanly.
2. Path safety: reject traversal / unsafe output_path (and document the rule).
3. Apply size + decode checks to Base64 too (not only input_path).
4. PIL verify(): reopen the image after verify() before reuse (classic gotcha).
5. Manifest / errors: document FILE_NOT_FOUND (and any new codes) in manifest.yaml error_code + keep instructions.md / catalog aligned.
6. [Skill Upgrade]: creative/bg_remover — hardening to 0.2.0 #257 deliverables still open:
   • examples/bg_remover_demo.py + examples/README.md row
   • wire docs/usage/agent_loops.md (not catalog-only)
   • optional first-run / model-download hint in response or docs (as scoped in the issue)
7. Prefer loading version/metadata from manifest.yaml instead of a second hardcoded dict in skill.py if other skills already do that pattern.

Bump is fine as 0.2.0 once the above is in. Ping when the PR matches the full #257 checklist, I will re-review <3