fix(skills): speed up picker reopening and remote discovery

[bobleer]

Summary

Opening the Skills picker repeatedly discarded completed results and duplicated requests that were still running, on both local and remote workspaces. Remote discovery additionally serialized every directory and skill-file operation over the workspace filesystem.

Retain the current picker catalog across close/reopen, share its pending request, and refresh on each later opening while displaying the previous result. Isolate results by device surface epoch, SSH connection, workspace, and mode; failed refreshes expose retry instead of leaving stale policy indefinitely. Remote discovery now runs at most four filesystem operations concurrently across two separate directory/file stages, preserving source precedence, directory ordering, symlink exclusion, and invocation policy. User-global discovery and remote project discovery also run together.

Type and Areas

Type: bug fix / performance

Areas: Rust core skill discovery; shared Web UI chat input

Motivation / Impact

The repeated-loading problem affects both local and remote users; remote network latency makes it more visible. In a 24-skill fixture with two roots and a 10 ms simulated delay per filesystem operation, the unchanged 82 logical IO calls took 984 ms before and 283–285 ms after this change (about 71% less elapsed time; observed peak concurrency 1 → 4). Scanning the equivalent local project fixture took 6.4 ms. These are local fixture measurements, not real SSH network benchmarks.

Verification

• pnpm run check:web — passed, including TypeScript and appearance/theme governance checks.
• pnpm --dir src/web-ui run test:run src/flow_chat/hooks/useResolvedModeSkills.test.tsx src/flow_chat/components/ChatInputBoostSubmenu.test.tsx — 17 passed; covers pending request reuse, completion while closed, background refresh, retry, and workspace/mode/connection/surface isolation.
• cargo test -p openbitfun-core --no-default-features --features agent-runtime,git --lib skills:: -- --nocapture — 26 passed; includes bounded remote IO, preserved order/policy, and equivalent local/remote project catalogs.
• cargo test -p openbitfun-core --no-default-features --features agent-runtime,git --lib skill_tool::tests — 13 passed; includes local/remote discovery, loading, dialect, and invocation-policy cases.
• pnpm run fmt:rs and git diff --check — passed.

Reviewer Notes

Remote workspace behavior was exercised through the production filesystem port with simulated latency and existing remote fixtures. Peer Device Mode cache isolation was exercised by changing surface epochs in hook tests. Live SSH, mobile/IM remote control, complete Peer Device Mode transport, and detached dispatch were not exercised end to end. This change does not alter command/wire formats, persistence, or source/policy ownership. The backend continues to resolve policy for invocation; the frontend snapshot is scoped to a mounted composer and revalidated on reopening.

The minimal agent-runtime lib-test profile alone hits an existing unrelated unguarded service::worktree test import; verification therefore includes its git owner.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable (no copy or format changes).