[1.0] Add bounded lazy Skill reference tools and revision tracking

Large Skill libraries need selective loading, but lazy access must stay confined to attached sources and must not silently disappear when an engine falls back to a non-tool program.

Scope

• Add runtime=True tools for attached Skill instructions and reference files, with per-agent bindings and explicit read/output budgets.
• Enforce containment after symlink resolution; reject access to unattached Skills and paths outside the allowed source.
• Record the actually used instruction/reference revisions for the run and reject unsupported tool/engine paths instead of silently falling back.

Acceptance criteria

• Two agents use the same immutable library in eager and lazy modes without modifying each other's bindings.
• Unattached sources, parent traversal and escaping symlinks cannot be read; oversized resources have explicit bounded behavior.
• Engine instruction overrides and program fallback cannot silently remove Skill access.
• Run evidence identifies the used content and resource revisions, while deterministic output/cascade behavior remains intact.

Boundaries

runtime=True does not authorize script execution. No demo injection, optimizer or general code sandbox.

References

• Implementation dependencies: #449, #442, #443.
• src/flock/engines/dspy_engine.py
• src/flock/core/context_provider.py
• docs/plans/2026-04-17-001-feat-agent-skills-internal-flock-plan.md

Start with the linked plan, then read src/flock/engines/dspy_engine.py and src/flock/core/context_provider.py, along with dependencies #449, #442, and #443. Trace how Skill sources, engine overrides, and fallback programs currently bind and expose content. Done means bounded lazy access is contained, per-agent bindings remain isolated, revisions are recorded, and unsupported paths do not silently remove Skill access.