refactor(runtime): split skills.ts along discovery/metadata/context/state seams #1408

Part of #1084 (second-pass sink-file and boundary governance). The file grew from 1189 to 1921 lines since the original scan (context governance + bounded search landed in between); the split is more valuable now. Scope re-verified against current main.

Scope

Split packages/runtime/src/skills.ts by the clusters visible today, keeping @maka/runtime exports (20+ symbols via index.ts) stable through re-exports:

• skills-discovery.ts: resolveSkillDiscoveryPaths, normalizeSkillSource, the scanSkills* family, scanSkillDir.
• skills-metadata.ts: validateSkillMetadata, parseSkillFrontMatter, the manifest-parsing family (~L1649–1901).
• skills-context.ts: gateSkillsByHostCapabilities, selectSkillsForContext, searchSkills + scoring, prompt rendering.
• skills-state.ts: readSkillRuntimeState, writeSkillRuntimeState.
• skills-agent-tools.ts: buildSkillAgentTool, buildSkillSearchAgentTool.
• Move readContainedRegularFile and the contained-file I/O helpers (~L1570–1645) into path-containment.ts — they are generic infrastructure and are already imported cross-package by apps/desktop/src/main/skills.ts.

Notes

Check overlap with #1385's child-session tool changes around buildSkillAgentTool before starting.

Invariants

Same as #1084: behavior-neutral; stable public exports via re-exports; no reverse imports; flat PR off main.

Verification

Typecheck/build + skills tests.