prepare skill management backend

[pmbstyle]

Summary

• Add octopal skill disable <skill-id> and octopal skill enable <skill-id>.
• Add runtime set_skill_enabled management tool so Octo can toggle skills without deleting bundles.
• Add dashboard API endpoints for the desktop/web UI to list, install, enable, disable, and delete skills.
• Store enable/disable as a registry override and clean that override when an installer-managed skill is removed.

Dashboard API

• GET /api/dashboard/skills
• POST /api/dashboard/skills/install
• POST /api/dashboard/skills/{skill_id}/enable
• POST /api/dashboard/skills/{skill_id}/disable
• DELETE /api/dashboard/skills/{skill_id}

The skills list returns UI-ready fields such as name, description, enabled, ready, status, origin, source, trust, runtime, requirements, and row-level actions.

Why

The desktop skills page needs a backend contract that does not expose raw registry/install-manifest details to the renderer. Operators also need a reversible way to keep a skill bundle on disk while removing it from active skill use. Disabled skills are still listed, but they no longer expose dynamic skill_<id> tools and use_skill/run_skill_script reject them as disabled.

Validation

• uv run pytest tests/test_dashboard_v2_api.py tests/test_skill_management.py tests/test_cli_skill_install.py -q
• uv run pytest tests/test_skill_management.py tests/test_cli_skill_install.py tests/test_tool_inventory.py tests/test_router_tool_budget.py -q
• uv run ruff check src/octopal/gateway/dashboard.py tests/test_dashboard_v2_api.py src/octopal/tools/skills/management.py src/octopal/cli/main.py tests/test_skill_management.py tests/test_cli_skill_install.py
• uv run octopal skill --help
• git diff --check