fix(skills): reserve Cloud-managed provider skills

[cnjack]

What changed

• Adds opt-in JCODE_MANAGED_SKILLS_DIR and JCODE_RESERVED_SKILLS runtime contracts.
• Loads managed Skills after built-in, agent, user, and project Skills so the trusted runtime copy has final precedence.
• Fails closed when a managed directory is missing or invalid: reserved names remain hidden.
• Prevents lower-trust Skills from impersonating a reserved Provider through either frontmatter name or an explicit slash trigger such as /github.
• Keeps existing desktop/CLI Skill precedence unchanged when the environment variables are unset.

Why

jcode Cloud injects GitHub/GitLab/Gitea Skills per immutable Run Plugin snapshot. Persistent HOME content or repository-local Skills could otherwise shadow those names and make the advertised runtime capabilities disagree with the CLI/credential snapshot.

Validation

• go build ./...
• go vet ./...
• golangci-lint against origin/main: 0 issues
• go test ./...
• go test -race ./internal/skills
• tests cover same-name and frontmatter-name shadowing, /github and bare github slash hijacks, missing/relative managed roots, Rescan, unselected reserved Skills, non-reserved precedence, and env-unset compatibility

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6ad1c834-ac56-4f97-9f22-4a627d637229

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/managed-provider-skills

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}