Explain why each skill is available or blocked

Problem

intent list shows available skills and can show hidden source summaries, but it does not identify the exact policy decision that made a package or skill available or blocked. Consumers must reconstruct the result from inherited intent.skills, wildcard matching, source kind, and intent.exclude rules.

User outcome

A human can inspect a skill-level diagnostic in human-readable or JSON form and understand why each relevant skill is available, blocked, or not discovered.

In scope

• Add an opt-in human-readable explanation mode for intent list, proposed as intent list --why.
• Add corresponding structured JSON fields with stable decision categories.
• Identify the controlling policy result for explicit package permission, wildcard permission, allow-all mode, absent migration mode, empty deny-all mode, package exclusion, skill exclusion, package not listed, source-kind mismatch, and configured-but-not-discovered entries.
• Add per-skill permission explanations after #219 defines that policy form.
• Report exclusion as the controlling result when a discovered package is both excluded and not listed; preserve the current suppression of the unlisted-source notice for explicitly excluded packages.
• Include the configuration file that owns the effective inherited intent.skills declaration in human explanation output when available.
• Preserve normal intent list output when explanation mode is not requested, including the existing human notice that names unlisted packages.
• Use intent list --why --show-hidden for detailed human review of hidden package and skill identities; --why without --show-hidden does not add hidden identities beyond the existing notice.
• Preserve agent redaction regardless of flags: agent sessions receive hidden counts and reasons without hidden package, skill, path, or source identities.

Out of scope

• Changing permission semantics.
• Content hashes, byte drift, or lockfile state.
• Delivery, placement, hook execution, or synchronization state.
• Git source implementation.

Acceptance criteria

Package-level explanations

• Human-readable explanation output identifies why each listed skill is available under the current package-level policy.
• intent list --why --show-hidden identifies why each human-reviewed hidden or excluded candidate is blocked.
• JSON explanation output identifies the package, skill when known, availability result, and stable controlling decision category.
• Output distinguishes explicit package permission, wildcard permission, allow-all mode, absent migration mode, and empty deny-all mode.
• Output distinguishes package exclusion, skill exclusion, package-not-listed, and source-kind-mismatch results.
• Exclusion is reported as the controlling result when it removes a package or skill, including a package that is also not listed.
• Configured packages that were not discovered use "not discovered" language rather than claiming they are not installed.
• Human explanation output includes the effective intent.skills configuration path when available.
• Normal human and JSON output remain compatible when explanation mode is not requested.
• The existing default human notice for unlisted packages remains unchanged.
• --why without --show-hidden does not add hidden package, skill, path, or source identities beyond the existing human notice.
• Agent sessions do not receive hidden package names, skill names, paths, or source identities, even when explanation or hidden-review flags are passed.
• Source-kind-mismatch details are available only in explicit human hidden review.
• The diagnostic does not report content, byte, lockfile, or delivery state.

Per-skill explanations

• After #219 is complete, output distinguishes an explicit per-skill permission from a package-level permission.
• After #219 is complete, configured skills that were not discovered use "not discovered" language.

Dependencies

• #219 for the two per-skill explanation criteria. Package-level explanations can ship independently.

Open decision

Confirm whether intent list --why is the final surface or whether the explanation belongs in another explicit diagnostic mode. The default intent list output must remain concise either way.

Start by tracing the existing intent list command and its human and JSON output paths, then review dependency #219 for the per-skill policy form. Define the final explicit diagnostic surface before implementation, keeping normal output unchanged and preserving agent redaction. Done means the acceptance criteria distinguish each listed policy result, exclusions, undiscovered entries, and hidden-review behavior.