fix(ecosystem): align source discovery and harden native imports

[kev1n77]

Summary

• Honor CODEX_HOME for Skill discovery and align Claude Command, Agent, Hook, and Skill discovery with CLAUDE_CONFIG_DIR.
• Report bounded OpenCode Skill root diagnostics while retaining valid sources.
• Add native management actions to imported Skill, MCP, and Hook rows.
• Bind single and batch Skill imports to the reviewed package fingerprint; reject changed content before publication.
• Reconcile MCP import status with current native configuration after imports, refreshes, and configuration changes.

Type and Areas

Type: Bug fix / feature / UI/UX

Areas: Rust core, ecosystem adapters, desktop/Tauri, web UI, localization

Motivation / Impact

Custom configuration directories could produce inconsistent discovery results, and invalid OpenCode Skill roots could disappear without explanation.

Users can now review a Skill package and import the same content they reviewed. Changes to its entry file, assets, or file set require a new preview. Existing copies and user edits remain protected.

Imported content links to its native management page. MCP status reflects whether the native copy still exists instead of retaining an outdated success state.

Verification

The following checks passed during implementation:

• cargo test --locked -p openbitfun-claude-code-adapter --test claude_code_source_contracts
• cargo test --locked -p openbitfun-opencode-adapter --test opencode_static_source_contracts
• cargo test --locked -p openbitfun-core --no-default-features --features agent-runtime,git,external-sources --lib agentic::tools::implementations::skills::
• pnpm --dir src/web-ui exec vitest run src/app/scenes/skills src/app/scenes/ecosystem-compatibility src/infrastructure/api/service-api/ConfigAPI.test.ts
• pnpm run check:web
• pnpm run i18n:audit

Desktop verification:

• cargo test --locked -p openbitfun-desktop --lib api::skill_api::tests compiled successfully.
• The generated test executable initially failed to start because its Windows Common Controls v6 manifest was missing. After embedding the manifest locally, all six focused tests passed.

These results precede the latest MCP follow-up commits. Final-HEAD verification remains to be recorded, including src/infrastructure/api/service-api/MCPAPI.test.ts.

Reviewer Notes

• Existing Skill source keys, import records, and legacy API calls remain compatible.
• Reviewed Skill imports are advertised through importOperationsVersion = 3.
• Claude MCP configuration retains its independent path handling.
• MCP CLI confirmation of previously reviewed plans is outside this PR.
• Remote workspace and Peer import restrictions remain in place. Remote behavior has unit coverage; no live remote integration testing was performed.
• English, Simplified Chinese, and Traditional Chinese strings are updated. No project documentation was modified.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.