Skills: namespace group keys (tier:/plugin:) to avoid collisions

Follow-up from AIR review on #94 (deferred there by decision).

**Problem.** Skill *group keys* share one unnamespaced key space between source tiers and plugins (`skillGroup` in `packages/server/src/agent/extensions.ts`): a tier is the literal `project`/`personal`/`bundled`/`pi`, and a plugin's key is the manifest name before `@`. Two consequences:

- A Claude plugin literally named `personal` / `project` / `bundled` / `pi` collides with a source tier — toggling either group disables both.
- Identically named plugins from different marketplaces (`foo@marketA`, `foo@marketB`) collapse to one group and are toggled together.

**Suggested fix.** Use namespaced stable group IDs (e.g. `tier:personal`, `plugin:`) throughout discovery (`skillGroup`), admission (`skillAdmission` / `SkillCatalogEntry.group`, `Project.disabledGroups`), persistence, and UI grouping (`apps/web/src/chat/SkillsDialog.tsx`), keeping human-readable display labels separate from the key. Note: `Project.disabledGroups` is persisted, so this needs a migration (or a read-time remap) for any already-stored bare keys.

**Severity.** Low real-world probability (reserved-word plugin name; dup-named cross-marketplace plugins), which is why it was deferred out of #94 rather than done inline — the fix is cross-cutting and touches a persisted format.

Start at skillGroup in packages/server/src/agent/extensions.ts and trace the related skillAdmission, SkillCatalogEntry.group, and Project.disabledGroups paths. Then inspect apps/web/src/chat/SkillsDialog.tsx and the persisted disabledGroups format. Done means tier and full plugin manifest keys remain distinct throughout discovery, admission, persistence, and UI grouping, with existing bare keys handled by migration or read-time remapping.

Written by the indexing model from the issue text.