#938 feat: package-owned skill resources

[hachej]

Summary

Consolidates package-owned skill resources for #938 without copying package skills into downstream workspaces.

• Adds browser-safe { filesystem, path } skill locators.
• Resolves direct and scanned package declarations through one package-resource snapshot controller shared by standalone Workspace and CLI hosts.
• Projects package and supported shared/global skill roots through one confined readonly multi-root filesystem binding.
• Reuses the canonical readonly projection engine instead of maintaining a second filesystem implementation.
• Keeps package installation paths server-private and rejects traversal, overlap, and symlink escape.
• Preserves Pi as the invocation and duplicate-name authority while the Skills pane can show distinct management resources.
• Makes @hachej/boring-bi-dashboard contribute its package root while package.json#pi.skills remains the sole skill declaration.
• Removes the transitional filePath wire fallback; supported rows use one resource identity.

Cross-filesystem conventional .agents/skills/*/SKILL.md discovery is now kept in the dependent #942 rollup, where path-sensitive read capabilities are defined.

Simplification pass

Four simplification loops reduced the review diff from +3,035 / −91 across 44 files to +2,190 / −240 across 42 files. A final independent pass found no remaining safe ≥20-line reduction and marked the implementation stable.

Key reductions:

• one readonly projection engine instead of two;
• one package snapshot pipeline instead of separate Workspace/CLI implementations;
• no custom skill-invocation HTTP protocol in Discover and open package-owned skills through readonly resource bindings #938;
• no redundant piSkillPath, systemPromptAppend, or filePath representations;
• smaller characterization and boundary-focused tests;
• registry-owned management projections and canonical path-containment logic;
• manifest prompts included directly in atomic snapshot generations;
• one shared package/shared skill-record resolver;
• linear speculative scan validation before one final cohort projection;
• no permanently empty static Pi snapshot or public one-use uniqueness helper;
• canonical browser path validation reused by the Skills pane;
• catalog-visible metadata, rather than full skill bodies, drives management-cache generations;
• repetitive package-resource security fixtures collapsed behind one test helper.

Consolidates

Supersedes the review surface of #949, #953, #956, and #958.

Proof

• pnpm typecheck:changed passes for changed packages and dependents.
• Agent focused package/resource suites pass; unrelated parallel full-suite timeouts pass in isolation.
• Boring Bash complete suite passes.
• Workspace package-resource, Skills UI, and composition suites pass.
• CLI workspace-mode package-resource suite passes.
• Root alignment, package, and plugin invariants pass.
• CI typecheck, lint, invariants, bundle budget, E2E, UI review, and remote-worker checks pass; remaining CI tests are still running.

Review order

Review this PR first. Do not merge until review is complete. The dependent #942 rollup follows.

Refs #938.