fix(skills): align discovery and source resolution, improve @ picker UX

[kev1n77]

Summary

Fix inconsistent local and remote skill discovery, missing nested skills, and missing user-visible scan diagnostics. Improve skill selection in the input field.

• Support bounded recursive scans under standard skill roots, including nested directories such as .system; follow directory symlinks while preventing traversal cycles.
• Apply the same override precedence to remote and local project skills so user-level skills do not incorrectly override project-level skills.
• Preserve stable skill identities for explicit selections. The @ picker shows only the winning entry for each name under the current mode's override rules, without displaying internal identifiers.
• Keep @ descriptions visible by default, truncate long descriptions with an ellipsis, and scroll them on hover. Disable detail tooltips in the picker, input skill tags, and installed skills list.
• Return and display scan diagnostics separately from available skills. A failure in one directory or file does not discard successfully discovered skills.

Related issue: None.

Type and Areas

Type: bug fix / UI/UX / docs / test

Areas: Rust core, Agent Runtime, desktop/Tauri, Web UI, design-system/Listbox, i18n, docs.

Motivation / Impact

Previously, standard-root scans inspected only immediate child directories, remote scans skipped symlinks, and remote merging omitted the project-priority offset used locally. This could omit skills or select the wrong override. Discovery failures were typically logged without a visible indication, making it difficult to distinguish an empty skill list from an incomplete scan.

Skill listings and invocation now preserve consistent source identities, and scan failures appear as visible diagnostics. The input field presents skill names according to the current mode's override results, with descriptions readable without hovering. Full details remain available on click.

Verification

The following results were recorded during implementation. Before committing, git diff --check and git diff --cached --check also passed.

• cargo test --locked -p openbitfun-core --no-default-features --features agent-runtime,git,external-sources --lib agentic::tools::implementations::skill: 61 passed.
• cargo test --locked -p openbitfun-agent-runtime --no-default-features --features agent-runtime --test agent_definition_contracts skill_contracts: 32 passed, including legacy report deserialization and serialization round trips.
• pnpm --dir src/web-ui exec vitest run src/flow_chat/components/ChatContextPickerOverlay.test.tsx src/app/scenes/skills/SkillsScene.presentation.test.ts: 17 passed.
• pnpm --dir src/web-ui exec vitest run src/flow_chat/components/RichTextInput.test.tsx: 29 passed.
• node --test design-system/packages/ui/tests/listbox.test.mjs: 3 passed.
• pnpm --dir design-system run build:ui: passed.
• pnpm run check:web: passed, including type, Appearance, theme color, and visual contract checks.
• pnpm run i18n:audit: passed with 0 warnings.
• pnpm run fmt:rs: executed.
• pnpm run motion:audit: executed. This command provides a checklist rather than visual acceptance testing. Its existing PortForwardDialog motion advisory is unrelated to this change.

Desktop verification:

• cargo test --locked -p openbitfun-desktop --lib api::skill_api::tests compiled successfully, but the test executable failed to load TaskDialogIndirect because it lacked a Common Controls v6 manifest, exiting with 0xc0000139.
• Copied the test executable within target/, embedded a temporary Windows manifest, and ran target/compatibility-discovery-audit/desktop-skill-tests.exe api::skill_api::tests: 4 passed. The temporary executable and manifest are not committed.

Verification limitations:

• pnpm run check:core-boundaries could not complete because of an existing broken dependency link at src/apps/mobile/harmonyos/entry/oh_modules/libbitfun_crypto.so (ENOENT).
• Remote workspace behavior was tested with a mock WorkspaceFileSystem covering nested scans, symlinks, cycle limits, read failures, and override order. No live SSH connection was tested.
• Remote Control, Peer Device Mode, and Detached Dispatch were not tested end to end. Packaging and cross-platform matrices were not run.

Reviewer Notes

• Existing keys for skills in immediate child directories remain unchanged. Nested skills use POSIX paths relative to their root to distinguish identically named directories in different containers.
• List commands return a report when the optional includeDiagnostics flag is enabled; otherwise, they retain the original array response. New clients accept legacy array responses from older hosts and indicate that diagnostics are unavailable.
• Explicit source selection still respects global and mode-level disable rules. User invocation entry points continue to apply author visibility settings. Default name-based resolution retains the existing override rules.
• Recursion stops when a SKILL.md is found, preventing reference examples inside a skill package from being treated as separately installed skills. OpenCode configuration roots retain their existing boundary constraints.
• ListboxOption forwards an explicit title="" to its text slots to disable automatic overflow tooltips. Other callers retain the default behavior.
• This change does not clean up or reset user data and introduces no required persisted fields. The automated checks above do not constitute final visual acceptance testing.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.