skills: inline @mention injects a denied skill's body without a permission check

Summary

A skill denied via permissions is still injected into the session when referenced with an @<skill-id> mention. The mention path loads the skill body directly and does not consult the skill permission.

Environment

• opencode version: 2.0.8
• OS: Darwin 25.6.0 (darwin arm64)
• Terminal: Ghostty, xterm-256color, truecolor
• Shell: /bin/zsh
• Install/channel: release/latest
• Active plugins: none

Reproduction

1. Configure:

   { "permissions": [ { "action": "skill", "resource": "create-plan", "effect": "deny" } ] }
   

2. Start a session and send @create-plan.

3. The full SKILL.md body is injected into the conversation despite the deny.

4. Control: loading the same skill via the skill tool returns {"type":"permission.rejected","message":"Permission denied: skill"}.

Expected Behavior

Per the docs, a deny effect "Hides matching skills from the model and rejects loading." An explicit mention should not bypass it, or the docs should define explicit user activation as a separate source/permission action.

Actual Behavior

The mention injects the skill body with no permission check. This was reproduced after a full client restart.

Additional Context

• Also tried metadata.opencode/slash: false and top-level slash: false in the skill frontmatter; neither affected the mention injection.
• Related: #43872 reports the inverse on 0.0.0-beta-17793 (@skill-id correctly denied, /skill-id bypasses). On 2.0.8 the @ mention appears not to route through the skill tool at all.

Trace the @ mention path and compare it with the skill tool path, which returns a permission.rejected response for denied skills. Start from the mention handling entry point and the skill permission check; done means a denied skill is not injected through an explicit mention and the existing allowed-skill behavior remains intact.