feat(skills): skill system + load_skill tool via per-turn tools filter

Skills are markdown in .skills/ dirs (~/.skills + <cwd>/.skills, cwd shadows home;
name = filename). Format: line1 summary, line2 ---, body line3+; load strips the
first two lines; malformed = no summary but still loadable.

Mechanism (first use of the context-assembly filter chain, §3.2):
- kernel: expose HostAPI.applyFilters (delegates to bus.applyFilters)
- session-orchestrator: define/export toolsFilter + ToolAssembly; apply once per turn
  before runTurn (cache-stable across steps), threading cwd + conversationId
- skills (new ext): pure parse/merge/render + load_skill tool (live read, path-contained)
  + a toolsFilter filter rewriting load_skill's description + name enum per cwd
- host-bin: register skills in CORE_EXTENSIONS
- transport-http: fix HostAPI test stub for the new applyFilters method (fan-out)

734 vitest + 109 bun = 843 tests; tsc -b EXIT 0; biome clean; clean live boot.

1 files changed, 7 insertions, 0 deletions

diff --git a/packages/kernel/src/host/host.ts b/packages/kernel/src/host/host.ts
index 8aa4f78..a6396a9 100644
--- a/packages/kernel/src/host/host.ts
+++ b/packages/kernel/src/host/host.ts
@@ -125,6 +125,13 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 			addFilter<TValue>(hook: FilterDescriptor<TValue>, fn: FilterHandler<TValue>) {
 				return deps.bus.addFilter(hook, fn);
 			},
+			async applyFilters<TValue>(
+				hook: FilterDescriptor<TValue>,
+				value: TValue,
+				opts?: { readonly failClosed?: boolean },
+			): Promise<TValue> {
+				return deps.bus.applyFilters(hook, value, opts);
+			},
 			provideService<T>(handle: ServiceHandle<T>, impl: T) {
 				deps.bus.provideService(handle, impl);
 			},