feat(desktop): integrate cloud workspace skills into UI

[Ooooze]

Desktop previously read the boot-time skills registry without a session and a separate legacy CLI list, so cloud project skills such as openspec-explore were absent from the UI. Integrate #627 into rel/xp-build and use the selected cloud session's live workspace catalog for the Skills pane, command palette and slash completion, including before the first message.

Skills show their chosen source and disabled reasons. Detail controls can disable a name in this workspace or globally, and the toolbar can disable all project sources while preserving global skills. Submission rechecks the catalog before sending the ordinary skill.view instruction. Catalog, detail and setting responses cannot replace a newer session's view; background catalog reads update the relevant surface without rebuilding the composer. Choosing another startup folder starts a new cloud chat, so a conversation bound to A cannot be mislabeled as B. Local mode retains its legacy catalog and restart semantics.

HTTP skills/capabilities add explicit workspace=true preview for an unsaved new session in the server's startup directory. Optional sessionId selects an existing session. No renderer-supplied filesystem path is accepted; context-free API calls retain their previous behavior.

Validation:

• Full Vitest: 1,129 files, 13,668 tests passed; 4 skipped, no quarantine exclusions.
• Desktop unit tests: 180 passed.
• Manual Electron check against an existing OpenSpec workspace: all six project skill commands appear before the first message.
• Real Electron E2E (workspace-skills.drive.mjs): pre-chat discovery, duplicate/source selection, all three disable scopes, palette and slash completion, stale invocation after a CLI policy edit, real runtime skill.view then reply, isolation in a second workspace.
• Windows smoke CI: both gates passed with the existing known-failure registry; x64 739 passed / 72 known failures, arm64 738 passed / 74 known failures, no unexpected failures.
• Root lint, typecheck:tests (773 existing debt diagnostics, no new errors), imports:check, docs:check and build passed; desktop lint/build passed.

E2E inference uses a deterministic loopback fixture. A real provider/model evaluation and packaging/signing are not part of these checks.