fix(skills): repair prod routing, deploy gate & telemetry gaps from s…

[deve1993]

…kill-system audit

Follow-up to the skills FTS fix (cc19df9). Audit of the skill invocation/usage path surfaced runtime/deploy gaps that the FTS fix alone did not cover.

Routing quality (skills-store.ts):

• route() drops non-task skills from recommendations (agent/command/lifecycle types + _routing-index) and over-fetches to preserve recall; these stay readable via skill_read/agent_read/command_read.
• recencyBoost normalized to [0,1] so a heavily-loaded skill can't out-rank a perfect lexical match on an unrelated query.
• get() falls back to agent:/command: prefixes for a bare name (exact match still wins), so skill_read('builder') no longer 404s.
• deadSkills() excludes protected System/Lifecycle categories (was false-positive noise in skill_health).
• Removed dead applySkillDecay/deprecateSkills prepared stmts (stale 10/30 thresholds; live path uses constants 5/20).

Deployment (entrypoint.sh, import-skills.ts, cli.ts):

• Boot import is now version-gated on a content hash of the bundled catalog, not first-boot-only. /data is a persistent volume, so unchanged-count redeploys previously skipped import and new skills never reached prod. Import stays additive (idempotent, FTS-safe upsert).
• import-skills --full: opt-in full-sync that soft-deprecates active skills absent from the bundle (reversible; never touches System/Lifecycle or drafts).

Concurrency & hardening (db.ts, routes/skills.ts):

• openDb sets busy_timeout=5000 (WAL + per-call connections vs the 24h decay UPDATE could hit SQLITE_BUSY with no retry).
• /telemetry/skill-usage: optional token gate via SKILLBRAIN_TELEMETRY_TOKEN (localhost-only endpoint feeds reinforceSkill / ~22% of routing weight).
• GET /api/skills/health now requireAdmin, matching sibling write routes.

Tests (storage 25, codegraph 294 green):

• New skills-store-fts-rebuild: corrupts the external-content FTS index (stale term + orphan + missing) and asserts migration 035's one-time rebuild repairs it — the prod-critical path that was previously untested.
• New skills-store-routing: route() exclusion, get() prefix fallback, deadSkills protected-category filter.
• import-skills: --full prune deprecates removed skills, protects System/Lifecycle.

Docs:

• packages/codegraph/docs/DEPLOY-SKILLS.md: two-DB model, propagation mechanisms, full-sync, telemetry reality.
• CLAUDE.md: corrected the skill-apply-hook note (local apply signal does not reach prod ranking in the remote-MCP setup).