bug(runtime-host): newly created Skills can be written to the wrong workspace directory

## What happened

The target is reliable local Skill creation in production Desktop. Production and development builds share the Runtime Host catalog and interactive composer, so the missing default-directory guidance is not development-only. The observed reproduction below was in a development build; production impact is inferred from the shared code path and has not been reproduced in a packaged release.

A Windows Maka Dev conversation created `learn-anything` from pasted text under the regular Maka data directory and reported success. Extensions → Skills → locally installed remained empty because the active Host used another root:

- Active root: `%APPDATA%\Maka Dev\workspaces\default`
- Actual file: `%APPDATA%\Maka\workspaces\default\skills\learn-anything\SKILL.md`
- Expected file: `%APPDATA%\Maka Dev\workspaces\default\skills\learn-anything\SKILL.md`

The agent then added `skill.lock.json` and suggested restarting. Neither changes the scanned root; ordinary workspace Skills do not require managed lock metadata to appear.

## How to reproduce

1. Run Maka Dev with a regular Maka data directory also present.
2. Use an empty Skill catalog and a conversation with working filesystem tools.
3. Paste valid Skill content and request a new local Skill without specifying a scope.
4. Check the destination and refresh the installed list.

The wrong destination is model-dependent. The deterministic code gap is the absence of an authoritative default creation directory in the prompt, including with an empty catalog.

## Environment

- Commit: `2310035a3`
- OS: Windows
- Surface: Desktop / Runtime Host
- Node.js: v24.19.0

## Root cause and resolution

The catalog repository knows the actual Host data root and scans `/skills`, but its model-facing snapshot did not expose the default installation directory. The interactive prompt renders available Skills and offers no location guidance when the catalog is empty.

Carry `/skills` into that snapshot and include creation guidance in main/child prompts independently of catalog contents. Direct the model to write `//SKILL.md` and read the exact file back before reporting success. Honor explicit project, user, or managed-source scope.

For packaged Windows Desktop, the usual local destination is `%APPDATA%\Maka\workspaces\default\skills`; custom or remote Hosts must use their actual root. The fix has no `isPackaged` condition or hard-coded development path.

## Boundaries

- This is host-backed prompt guidance, not a new creation tool or enforced write redirect. Models may still disregard it.
- Permissions and sandbox rules remain authoritative; Windows sandbox unavailability is a separate issue.
- No migration of misplaced files, discovery-precedence change, UI auto-refresh change, or installation-governance change.
- Ordinary workspace Skills need no fabricated managed locks; managed-source installation retains its existing metadata handling.

Prepared and submitted with OpenAI Codex at the contributor's request.

中文说明

## 实际发生的问题

目标是让生产版 Desktop 可靠地创建本地 Skill。生产版和开发版共享 Runtime Host 目录仓库和交互提示组装器，因此缺少默认目录指引并非开发版独有的问题。下方实际复现来自开发版；生产版影响是根据共享代码路径作出的推断，尚未在打包发布版中复现。

Windows 的 Maka Dev 对话根据粘贴文本创建 `learn-anything`，将其写入正式版 Maka 的数据目录并报告成功。“扩展 → Skills → 本地安装”仍为空，因为当前 Host 使用了另一个根目录：

- 当前根目录：`%APPDATA%\Maka Dev\workspaces\default`
- 实际文件：`%APPDATA%\Maka\workspaces\default\skills\learn-anything\SKILL.md`
- 预期文件：`%APPDATA%\Maka Dev\workspaces\default\skills\learn-anything\SKILL.md`

代理随后补写了 `skill.lock.json` 并建议重启。这两项操作都不会改变扫描根目录；普通工作区技能不需要 managed 锁元数据即可显示。

## 如何复现

1. 运行 Maka Dev，同时本机存在正式版 Maka 的数据目录。
2. 使用空 Skill 清单以及文件系统工具能够正常工作的对话。
3. 粘贴有效 Skill 内容，要求创建本地技能，不指定作用域。
4. 检查写入位置并刷新安装列表。

写错位置取决于模型。确定的代码缺口是提示中缺少权威默认创建目录，包括清单为空时。

## 环境

- 提交：`2310035a3`
- 操作系统：Windows
- 使用界面/组件：Desktop / Runtime Host
- Node.js：v24.19.0

## 根因与解决方式

目录仓库知道真实的 Host 数据根目录并扫描 `/skills`，但面向模型的快照没有提供默认安装目录。交互提示渲染可用技能，清单为空时没有位置指引。

将 `<真实 Host 根目录>/skills` 传入该快照，并无论清单内容如何，都在主对话和子对话提示中加入创建指引。要求模型写入 `//SKILL.md`，并在报告成功前回读确切文件。尊重明确指定的项目级、用户级或 managed-source 作用域。

Windows 打包版 Desktop 通常的本地目标位置是 `%APPDATA%\Maka\workspaces\default\skills`；自定义或远程 Host 必须使用其真实根目录。修复没有 `isPackaged` 条件或写死的开发版路径。

## 边界

- 这是有 Host 依据的提示指引，不是新的创建工具或强制写入重定向。模型仍可能不遵从。
- 权限和沙箱规则仍具有约束力；Windows 沙箱不可用是独立问题。
- 不迁移错放文件，不改变发现优先级、界面自动刷新或安装治理机制。
- 普通工作区技能不需要伪造的 managed 锁；managed-source 安装保留现有元数据处理。

本 Issue 由 OpenAI Codex 按贡献者请求协助准备并提交。

Start at the Runtime Host catalog repository and the model-facing snapshot, then trace the main and child prompt assembly. Verify that the Host’s actual skills directory is carried into the snapshot and that both prompts provide scope-aware creation guidance; done means the empty-catalog case points to the correct root without a packaged-build or hard-coded development-path condition.

Written by the indexing model from the issue text.