Skills store: prep work for the MCP Skills extension (SEP-2640)

Context

The MCP Skills extension (io.modelcontextprotocol/skills, SEP-2640, overview) lets an MCP server serve Agent Skills natively. A host lists them at connect time, shows them in its own skill picker next to local skills, asks the user to approve, and injects them like a local skill. Today the PostHog MCP server delivers store skills only through the exec learn tool verb and the skill-* tools.

What the extension needs from a server:

• Every skill file is a resource at skill://<prefix>/<name>/<file-path>. The final path segment must equal the frontmatter name.
• skills/list returns entries of {uri, frontmatter, resources} where resources is [{uri, digest: "sha256:<hex>", size}] (size in bytes) or the string "dynamic".
• skills/get returns one entry by URI.
• Content is read with plain resources/read, and the bytes must match the listed digest and size exactly. The parsed frontmatter of SKILL.md must match the listed frontmatter field for field.
• Hosts namespace skill names per server, bind approval to the exact digest set, and ignore allowed-tools for MCP-origin skills.
• Limits hosts must support: 512 files and 16 MiB per skill.

The Skills store (products/skills/) already follows the Agent Skills format for names, descriptions, body, and files, but several primitives the extension relies on exist only in the zip export and git marketplace path, or not at all. This issue tracks the store-side prep. Implementing skills/list and skills/get in services/mcp is a follow-up once these land.

Sub-issues

Each sub-issue is one PR.

Shared touchpoint: #99934 and #99936 must both render SKILL.md through the same render_skill_md call and a shared frontmatter_document helper in products/skills/backend/marketplace/packaging.py, or the digests will not match the served bytes.

Already compatible, no change needed

• Name pattern ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$, 64 chars max, no --
• Description capped at 1024 chars on write
• skill.md is a reserved bundled file path
• 1 MB body and 1 MB per file, well inside the extension's 512 files and 16 MiB per skill

Out of scope here

• skills/list, skills/get, and skill:// resources in services/mcp/src/hono/dispatcher.ts
• Changes to the skills-first gate in services/mcp/src/tools/exec.ts
• Any frontend work

This is an umbrella issue with eight independently scoped sub-issues; start by choosing one and reading its dependency row. For the shared rendering requirement, inspect products/skills/backend/marketplace/packaging.py and the render_skill_md and frontmatter_document entry points. Done means the selected prep work is implemented without changing services/mcp or the skills-first gate.