fix(providers): discover skills in the active workspace

[rynfar]

Project skills were missing from the composer, and large OpenCode inventories could be truncated into an empty list. This ports four upstream fixes for workspace discovery across Codex, Claude, Cursor, Grok, and OpenCode, including mobile composers and externally symlinked Cursor skill packages.

Pylon keeps its live session command catalog, interaction controls, provider capacity ownership, and exact session admission. Discovery belongs to the reactor scope. Failed Cursor scans remain retryable instead of caching an empty session catalog. Prime keeps its existing session resource controls.

Validation: focused provider, shared-client, mobile-menu, and reactor tests pass; contracts, shared-client, server, web, and mobile typechecks pass; targeted lint passes.

Upstream: #8778, #9180, #9585, #9420.

Integrated Chromium verification used a controlled workspace-scoped provider snapshot to verify composer skill visibility and scope labels. Server discovery itself is covered independently by the focused provider tests. No live provider invocation or native-device verification is claimed.

Client verification evidence

skills-and-quit-verified.webm

Model: GPT-6 Astra. Harness: Codex.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.8 KiB	+25 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+13 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.7 KiB	+12 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.4 KiB	57.4 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.8 KiB	+141 B (+1.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−12 B (−0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.7 KiB	+153 B (+2.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.3 KiB	58.2 KiB	+884 B (+1.5%)	66.4 KiB	✅
Claude	Live turn messages	8	9	+1 (+12.5%)	21	✅

Baseline: 50c1de0 · PR result: 8a44ea6 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 111.2 KiB
• Claude decoded thread snapshot: 111.9 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.