Deliver approved skills automatically at startup for every supported harness #962

Problem

Approved skill updates currently reach the machine through manual kcap skills sync or an opt-in Claude-only background refresh throttled to six hours. Other supported agents do not automatically get a fresh catalogue when their sessions start.

Outcome

For a configured/authenticated Capacitor integration, normal session startup automatically supplies the latest eligible skills to the intended repository and harness, without a separate skills.auto_sync opt-in or manual synchronization.

Scope

• Use one shared snapshot-fetch/reconciliation routine, invoked by each harness's native lifecycle/resource adapter.
• Make a bounded conditional snapshot request on real session startup/resume. Preserve ETag efficiency while removing the six-hour suppression of fresh-session checks. Coalesce duplicate callbacks without suppressing a distinct session.
• Install through Materialized skills are offered in every repo: scope them to the repo they came from #778's managed repo/worktree-scoped materializer, then perform the harness-specific action needed to refresh its available-skill catalogue before the intended model request.
• Cover Claude, Codex, Cursor, Copilot CLI, Gemini CLI, Kiro CLI, Pi, OpenCode and Antigravity with explicit version/launch-mode capability checks.
• Support existing direct-user launches and daemon launches. Where a hook is too late, implement an automatic supported resource-registration/reload or earlier lifecycle integration; a manual pre-sync requirement is not the target behavior.
• Define bounded timeout, offline cache and authentication/server/profile-switch behavior. A failed fetch must not be interpreted as an empty authoritative snapshot; stale-content policy and diagnostics must be explicit.
• Reconcile centrally revoked or newly ineligible skills on a successful refresh. Keep session-kind/flow-role restricted documents on their existing safe delivery route unless the adapter actually isolates sessions.
• Wire setup/upgrade paths so existing configured integrations receive the behavior; keep kcap skills sync as an explicit refresh/diagnostic command.
• Expose enough status to distinguish files written, skill catalogue refreshed, stale cached data and unsupported loading behavior.

Acceptance criteria

• Approve a skill and launch a matching agent in a fresh checkout: the first eligible request can discover and load it.
• Re-approve or revoke centrally, then start/resume a session: its native catalogue reflects the new snapshot.
• All supported harness/version/mode entries use the verified compatibility mechanism; no silent claims based only on a hook completing.
• No separate auto-sync opt-in or six-hour delay; repeat hook callbacks and concurrent sessions do not corrupt state.
• Generated files stay untracked and user-authored skills remain intact.
• Automated lifecycle tests and targeted native conformance checks cover first install, update, revocation, timeout and scope isolation.

Dependencies

• Repo-local materialization and migration: Materialized skills are offered in every repo: scope them to the repo they came from #778.
• Runtime compatibility probes: Verify repo-local skill discovery and startup ordering across harnesses #961.
• Server project/org scope: AI-2525 is required for the project-scope integration case, but repo-only delivery can be implemented independently.

Umbrella: AI-2828
Research: harness documentation and source audit