chore(skills): document that allowed_tools has no effect for MCP-served skills

Part of #99933.

Problem

LLMSkill.allowed_tools (products/skills/backend/models/skills.py) is exported as the Agent Skills allowed-tools frontmatter field by render_frontmatter in products/skills/backend/marketplace/packaging.py. The MCP Skills extension requires hosts to ignore allowed-tools for skills that arrive over MCP unless the user explicitly approves that grant for that skill. Once store skills are served over the extension, the field will keep working for zip export, the git marketplace, and the bundle install, but not for MCP delivery. Authors should know that before they rely on it.

Change

Docs and help text only. No behavior change.

1. Update the help_text on the allowed_tools field in LLMSkillSerializer and the create and update serializers in products/skills/backend/api/skill_serializers.py to say the list is honored when the skill is installed locally (zip, marketplace, bundle) and ignored by hosts when the skill is loaded over MCP. Keep it to one or two sentences. Run hogli build:openapi so the generated types carry the new text.
2. Update the skill-create and skill-update tool descriptions in products/skills/mcp/tools.yaml if they mention allowed_tools, then regenerate the MCP tool definitions with the script in services/mcp/scripts/ and check in the updated services/mcp/schema/*.json.
3. Add a short section to docs/internal/skills/ (the bundle API doc or a new skills-over-mcp.md) explaining the difference and linking to the extension spec: https://modelcontextprotocol.io/extensions/skills/overview
4. If products/skills/skills/skills-store/SKILL.md describes allowed_tools, update it to match and run hogli lint:skills.

Tests

None beyond the existing schema drift checks in CI (hogli build:openapi and the MCP schema check).

Notes

• Skills: /writing-user-facing-copy for the help text.

Start with the allowed_tools help_text in products/skills/backend/api/skill_serializers.py and the tool descriptions in products/skills/mcp/tools.yaml. Run hogli build:openapi, regenerate MCP definitions with the script in services/mcp/scripts/, and review docs/internal/skills/ plus products/skills/skills/skills-store/SKILL.md. Done means the local-versus-MCP distinction is documented and generated schemas pass the existing checks.