[FEATURE]: Support source-aware permissions for skills

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Skill permissions are currently evaluated by skill ID without considering where the skill was discovered.

This creates a trust-boundary issue because a project-local skill can override a trusted global skill with the same ID. Allowing that ID therefore also allows the project-provided replacement.

It would be useful for skill permissions to consider provenance, allowing policies such as:

global skills  -> allow
project skills -> ask / deny

Alternatively, provide an option to disable project skill discovery while keeping global skills enabled.

This would allow users to trust explicitly installed skills without implicitly trusting skill definitions provided by arbitrary repositories.