skill hot-reload and dynamic discovery for SkillManager

[yai-dev]

Summary

Add skill hot-reload and dynamic discovery on top of the current SkillManager model.

Current State

The current repo already has a SkillManager in packages/capabilities that discovers skills from {dataDir}/skills, but discovery is effectively request-time / startup-time only and there is no watcher-based reload path.

Proposed Design

1. Extend the current skill-management layer with optional filesystem watching
2. Refresh available-skill metadata when skill directories are added, changed, or removed
3. Make the behavior explicitly opt-in for production
4. Preserve path-safety guarantees when loading skill directories

Affected Areas

• packages/capabilities/src/skills/skill-manager.ts
• skill capability/tool integration
• host/app defaults that expose skills to agents

Acceptance Criteria

• Skill discovery can be refreshed dynamically from the filesystem
• Dev mode can enable hot reload by default while production stays opt-in
• Removed skills are retired safely
• Path traversal / unsafe-directory handling is covered by tests
• Documentation explains the lifecycle and trust model clearly