Add repo and task-level skill scoping

Summary

Add repo-level and task-level skill scoping so Jcode can hide irrelevant global skills from a project, while still allowing planned discovery of skills that may become relevant.

Current behavior

Jcode loads skills from:

• ~/.jcode/skills/
• <repo>/.jcode/skills/
• <repo>/.claude/skills/

All loaded skills are shown in the # Available Skills section of the system prompt and in slash autocomplete. Project-local skills can override a global skill with the same name, but there is no native allowlist, denylist, or lock file for a repo.

A quick code check suggests allowed-tools in skill frontmatter is parsed and displayed by skill_manage, but activating a skill does not apply it as an agent tool allowlist. Tool allowlists exist separately at the agent level.

Requested feature

Support a small repo config file that controls which skills are visible, hidden but discoverable, or blocked for the current project.

Example shape:

{
  "version": 1,
  "mode": "allowlist",
  "include": ["graphite-pr", "cflx-*", "request-code-review", "simplify"],
  "exclude": ["supabase", "firecrawl-*"],
  "discoverable": ["find-skills", "supabase"]
}

Suggested behavior:

• Visible skills appear in # Available Skills, slash autocomplete, and skill memory retrieval.
• Discoverable skills are not loaded into normal prompt context, but can be found during planning or explicit skill search.
• Blocked skills are not invokable unless the user explicitly overrides the project policy.
• Project-local skills should still override global skills by name.
• Subagents or swarms could optionally receive a small skill scope, such as review-only, cflx-only, or no-skills.

Why this helps

• Keeps the system prompt smaller for projects with many global skills.
• Reduces accidental activation of irrelevant skills, such as framework-specific skills in repos that do not use that framework.
• Allows planning workflows to discover skills before adding a new technology.
• Makes subagents easier to brief because they only see skills related to their task.
• Builds on the existing distinction between global and project-local skills without changing the skill format.

Notes

This does not need to be a large plugin system. A first pass could just filter the loaded SkillRegistry for prompt listing, slash autocomplete, slash invocation, and synthetic skill memory entries.

Start by tracing the existing SkillRegistry and the skill-loading paths from ~/.jcode/skills/, /.jcode/skills/, and /.claude/skills/. Then follow how skills feed prompt listing, slash autocomplete and invocation, and synthetic skill memory entries. Done means a repo config can distinguish visible, discoverable and blocked skills while preserving project-local overrides.