Skills 1/6: discover skill folders from every harness into one catalog #1403

Step 1 of #1277. It lands in the single pull request for #1277 (branch feat/1277-skills), as its first commit.

What

internal/skills scans the skill folders other harnesses already use and returns one catalog. It reads them in place and never copies them.

• Eight folders, first under the project (the git root of where codeaf was opened, else the folder itself), then under the home directory: .codeaf/skills, .agents/skills, .claude/skills, .codex/skills, .cursor/skills, .gemini/skills, .opencode/skills, .goose/skills.
• After those, within each scope: the skills of installed and enabled Claude Code plugins, then Codex's bundled skills (.codex/skills/.system).
• A skill is a direct child folder holding SKILL.md. A link to a folder counts. Nothing is walked deeper, so the resident's promoted commands in ~/.codeaf/skills (no SKILL.md) are not seen.
• First seen wins a name. Every loser stays in the result marked shadowed, so "why is my skill not used" has an answer.
• Frontmatter is read leniently, per the agentskills.io client guide. A bad name or a name that differs from its folder loads with a warning. A missing name or description, or YAML that won't parse, is skipped with the reason. An unquoted description containing a colon is repaired.
• Each skill carries its size (the bytes of every file in its folder).

Acceptance

The package is pure, so its tests run against fixture trees under testdata/:

• precedence across scopes and folders
• each skip and warning case
• links, including dangling ones
• plugin skills and Codex's bundled ones
• the OpenCode and Goose folders

go test ./internal/skills is green.

Carried over from #1396 (Santosh), with the two folders the plan adds.