feat: harden the agent-native skill runtime

[CountableNewt]

What changed

• exposes exactly resolve_context, get_skill, and report_skill_feedback by default
• keeps three hidden compatibility aliases for one release and disables generated skill tools by default
• targets MCP 2025-11-25 with typed schemas/results, negotiation, pagination, annotations, resource links, and correct JSON-RPC behavior
• supports standard Agent Skills packages plus .mycontext/skills.yaml policy, bounded package files, versioned ctx resources, and transactional persistence
• unifies deterministic activation, exact scope identities, capability fallbacks, conflicts, provenance, and resolution traces
• removes unused embedding controls and makes feedback behavior truthful

Dependency

Depends on Railway cleanup PR #28 merging to dev first; after that this PR contains only MCP-5 runtime and dashboard changes.

Verification

• web lint and both TypeScript configurations passed
• 143 web tests passed
• production Next.js build passed
• 191 Swift tests passed with warnings-as-errors
• Swift release build passed with warnings-as-errors
• six real central skills parsed, validated, and compiled without manual assignments
• fresh PostgreSQL 16 integration suite passed
• additive migration completed against the prior-binary schema

Risk and rollout

Development only after required CI. Deploy Gateway before Web, verify authenticated Codex and Claude scenarios, then soak for one hour. Production remains blocked by MCP-4 and explicit approval.

Linear: MCP-5

[linear-code]

MCP-2

MCP-5