refactor(core): skill service stores values, config plugin owns the filesystem

[kitlangton]

What

• Makes the skill service a pure registry of loaded Skill.Info values.
• Moves all filesystem scanning, parsing, URL loading, and watching into ConfigSkillPlugin.
• Continues the core-service direction established by fix(core): reload changed skill sources #40954.

Why

Core services should not be filesystem-aware. Embedded and SDK-registered skills are now the normal value-registration path rather than a special source variant, and the skill service drops four infrastructure dependencies to one (Bus.node).

How

• Changes skill state from Source[] to an ID-keyed Info registry.
• Replaces draft.source with list/add/update/remove; add upserts by ID and later transforms win.
• Relocates directory/URL loading and first-missing/symlink watching to ConfigSkillPlugin.
• Rescans all configured skill sources on relevant filesystem changes and config.updated, preserving the previous coarse invalidation granularity.
• Skill.Service.reload() re-runs registered transforms against current values; filesystem rescanning is owned by ConfigSkillPlugin through watchers and config.updated.
• Degrades URL discovery failures per source: logs a warning and continues activating directory and other URL skills.
• Extracts markdown/frontmatter parsing into the pure SkillFile.parse helper and debug-logs skipped files with a markdown/frontmatter reason plus schema issue details when available.

Testing

• bunx tsgo --noEmit in packages/core and packages/plugin.
• bunx tsgo -b tsconfig.json tsconfig.tests.json in packages/core.
• Targeted skill/config/plugin tests: 15 passed, including URL-source degradation, parser skip reasons, entry mapping, deletion, canonical symlink watches, and source-symlink retargeting.
• Pre-push bun turbo typecheck --concurrency=3: 33 packages passed.
• GitHub Actions: unit and e2e passed on Linux and Windows; typecheck and repository checks passed. The prior Windows @opencode-ai/util:build failure did not recur.
• Broader local core suite: 1628 passed, 16 skipped, 1 unrelated local-environment failure in PluginSupervisor config > logs invalid packages and continues loading because two user-configured plugins appeared in its exact-list assertion.

Findings

• Skill.sources() had no server route, protocol, client, or TUI consumers; only tests used it, so it was removed without retaining a compatibility surface. Skill.Source remains in @opencode-ai/schema for config parsing.
• Plugin effects already receive FSUtil, but not Watcher.Service or SkillDiscovery.Service. Both are now provided by PluginInternal.services; SkillDiscovery.node was added to the supervisor graph, while Watcher.node was already a supervisor dependency.