feat(skills): auto-bundle declared skill dependencies in cloud runs

[tatoalo]

Problem

skills that depend on other skills required the user to tag every dependency by hand in a cloud run. Tagging only the parent skill left its dependency missing in the sandbox, so the parent couldn't invoke it.

Changes

auto-bundle a tagged skill's declared dependencies for cloud runs:

• add an optional dependencies: list to SKILL.md frontmatter (parseSkillDependencies, supports block and flow YAML sequences).
• SkillsService.resolveSkillBundleDependencies transitively expands a set of skill refs to include declared dependencies (BFS, cycle-guarded; skills that resolve to a built-in already present in the sandbox are skipped). Exposed via skills.resolveDependencies.
• CloudArtifactService.loadCloudSkillBundles expands refs through that resolver before uploading, so the dependency bundles ride along on both the initial and follow-up upload paths. No-op when there are no tagged skills

[tatoalo]

• fix(agent): apply local-skill context on the codex adapter #3058
• feat(skills): auto-bundle declared skill dependencies in cloud runs #3057 👈 (View in Graphite)
• fix(cloud-task): bundle a local skill tagged on the first message #3056
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 3fe9f10.}

[greptile-apps]

_{Reviews (1): Last reviewed commit: "feat(skills): auto-bundle declared skill..." | Re-trigger Greptile}

[github-actions]

No showstoppers. The dependency-resolution feature is well-structured, follows project DI and layering conventions, and both P2 bot-flagged issues (RegExp metacharacter injection and silent truncation) were properly addressed before the current head.

[greptile-apps]

_{Reviews (2): Last reviewed commit: "feat(skills): auto-bundle declared skill..." | Re-trigger Greptile}

New commits pushed (delta classified non_linear_history) — stamphog approval dismissed; re-review running automatically.

[github-actions]

Well-structured additive feature with proper layering: fs operations in workspace-server, types/tokens in core, thin tRPC router forwarding, and DI wiring only in the host. Both P2 issues flagged by the bot reviewer (regex injection and silent truncation) were addressed before the current HEAD — the fix uses startsWith instead of new RegExp(key), and the BFS now throws on graph size overflow rather than silently truncating. Cycle detection via seen set is correct, tests cover transitive deps, cycles, built-ins, and the oversized-graph error path.

[stamphog]

Retaining stamphog approval — delta since last review classified as merge_only.