[codex] Add on-demand high-fidelity skills

[mimeding]

Business rationale

High-fidelity skills should make Osaurus more useful as a local agent harness without making every chat slower or more expensive by default. This advances the agents, plugins, and file-fidelity pillars by letting users discover business-file and contributor skills on demand, then load them only when the task needs that extra context.

Coding rationale

The activation model stays backward compatible with existing Agent Skills metadata while adding Osaurus-specific discoverability, default-selection, and on-demand fields. Session-loaded skills are persisted in SessionToolStateStore so capabilities_load has real chat-lifetime effects instead of being a one-shot tool response. Startup injection filters to activation-selected skills, while on-demand skills stay indexed for capabilities_search and can still be loaded explicitly. The first-party pack is shipped as portable markdown under skills/first-party with marketplace metadata, keeping skill content maintainable outside app binaries.

What changed

• Add backward-compatible Osaurus skill activation metadata for discoverable, default-selected, and on-demand behavior.
• Persist skills loaded through capabilities_load in session state so they stay available for the chat without becoming globally selected.
• Keep high-fidelity skills out of startup prompts unless selected or loaded, while indexing them for capabilities_search.
• Add a portable first-party high-fidelity skill pack under skills/first-party with .claude-plugin/marketplace.json import metadata.
• Update public docs to match the post-Deprecate Work Mode (migrate into single Chat / Agent system) #893 single Chat/Agent loop and lightweight activation model.

Validation

• swift build --package-path Packages/OsaurusCore: passed.
• swift build --package-path Packages/OsaurusCore -c release: passed.
• swift test --package-path Packages/OsaurusCore: passed, 1445 tests in 194 suites; sandbox integration skipped behind its env var.
• xcrun swift-format lint --strict on touched Swift files: passed.
• swiftlint lint --strict on touched Swift files: passed.
• git diff --check: passed.
• CLI gate skipped: this PR does not touch Packages/OsaurusCLI.

Non-scope

• Does not add PPTX/XLSX business-file services; this PR only provides the lightweight activation/runtime skill foundation.
• Does not change model-provider routing or Work Mode behavior.

Residual risks

• GitHub CI must still finish on the rebased branch.
• The file-level opening_brace disables exist only where SwiftFormat and SwiftLint disagree on multiline condition layout; future lint config cleanup could remove them.

Notes

• Assumes PR Deprecate Work Mode (migrate into single Chat / Agent system) #893 is implemented: this targets the single Chat/Agent loop, not legacy separate-mode flows.
• Direct push to osaurus-ai/osaurus was denied for the authenticated account, so this PR is maintained from the mimeding/osaurus fork.

[mimeding]

CI note: test-core failed in the Xcode build phase before running tests with EventSource module-resolution errors: CAsyncHTTPClient, CNIOLLHTTP, CNIOExtrasZlib, CNIOPosix, and _NumericsShims. This matches the known EventSource/toolchain failure class from the recovery plan, not a failure in the new skill tests. Local package builds were clean, and the focused skills/session/capabilities tests passed. Leaving this PR as draft until test-core is resolved or rerun under a fixed CI/toolchain baseline.

[mimeding]

Recovery-plan note: the latest CI shape is swiftlint, shellcheck, and test-cli passing, with test-core failing in the shared EventSource module-resolution class. #975 is green and should be merged first, then this PR should be rerun before touching the high-fidelity skills code.

This PR also remains aligned with the lightweight activation strategy: installed/discoverable by default, no high-fidelity skill prompt injection unless selected or loaded on demand.