Avoid parsing skill metadata rejected by effective policy

Problem

Policy-controlled discovery scans skill metadata before applying permission and exclusion rules, doing work for content that will never be exposed.

Evidence

With intent.skills: [] and 100 installed skill packages, listIntentSkills returned zero skills but reported 101 package manifest reads. scanForPolicedIntents calls the raw scanner before policy resolution, and registration discovers skills before filtering.

Sources: scan ordering, registration.

Verified against main at 206e987 (@tanstack/intent 0.3.8), Node v24.12.0 on macOS arm64. Tests used installed dependencies and synthetic local fixtures.

Acceptance criteria

• Measure package reads, skill-file reads, output, and elapsed time before and after on the same fixtures.
• Resolve and validate policy before policy-controlled metadata parsing.
• Agent-visible discovery does not parse denied skill files.
• Preserve traversal needed to locate permitted transitive packages through unlisted parents.
• Preserve human review of hidden candidates and current policy diagnostics through an explicit appropriate discovery path.
• Show identical permitted results and a measured reduction in denied-content work, with no weakening of path or policy checks.

Scope and priority

Priority: Medium. Type: performance.

Follow-up optimization after policy correctness fixes. No persistent cache, broad scanner rewrite, or new dependency solely to optimize this path.

Start with packages/intent/src/core/source-policy.ts at scanForPolicedIntents and packages/intent/src/discovery/register.ts around registration. Reproduce the synthetic-fixture measurements for package reads, skill-file reads, output, and elapsed time, then trace policy resolution and transitive traversal. Done means denied skill files are not parsed, permitted results and diagnostics remain unchanged, and the measured reduction is documented by tests or fixtures.