CM-71972: Collect Claude Code skills in the Guardrails session sweep

[Altruistus]

TL;DR

A developer installs a skill from a marketplace into ~/.claude/skills/, never commits it, and Cycode's Skills inventory shows nothing. The session-start hook already sweeps every IDE for MCP configs; this adds skills to the same sweep and the same report, so an installed skill becomes visible without anyone having to commit it.

Why

Skills inventory has only ever seen a SKILL.md that reached a repository. The instructions and scripts a marketplace skill carries have been invisible — worst of all for people with no SCM footprint at all. The backend can already inventory a reported skill; it just needs the CLI to report one.

Reviewer notes

• Skills get their own collector rather than riding in config_files[]. The backend parses every entry there as an MCP server map, and a skill is a directory of Markdown, not a normalizable JSON config.
• Plugin skills are the exception and hang off the plugin entry, because that is what carries the marketplace, plugin and version a marketplace-installed skill came from. The plugin readers already hold the resolved directory, so the scan is shared and all three IDEs with a plugin system get it — the skills/ layout belongs to the plugin format, not to any one IDE.
• Raw content is sent, not parsed frontmatter. Parsing belongs to the backend, which is also the only option for the device connectors that read these files off endpoints and can return nothing but file bytes.
• Two caps that the MCP collectors did not need. A SKILL.md body is unbounded prose and the number of installed skills is unbounded too. One request carries the whole session context, so an oversized skill would otherwise cost the device its MCP inventory as well.
• User-scope collection is Claude Code only, deliberately. It is the only tool with a SKILL.md convention of its own today — Cursor's .mdc rules and CLAUDE.md are rule files, a different category. The hook is generic (IDE.get_skills defaults to empty), so adding another IDE is two lines once its skills directory is confirmed rather than guessed.
• A test-isolation bug surfaced on the first run and is fixed here. The existing session-context tests read the developer's real ~/.claude/skills, so their assertions depended on whose machine ran them. An autouse fixture now pins the sweep.
• Project-scope skills (<repo>/.claude/skills/) are out of scope: there is no repo-scope collection in this app at all, which is structural plumbing rather than a missing path.

CM-71972

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}