fix: harden host-specific skill generation

[time-attack]

Summary

This reconstructs three small, independently reviewed fixes from the rejected wave-hosts bundle:

• make Hermes-generated frontmatter identities match their namespaced skill directories, preventing collisions with unrelated skills such as review;
• make Codex-generated /ship load qa-only from the Codex generated-skill root instead of a Claude-only path;
• make skill:check honor the primary host's configured skipSkills entries.

The original 100-file wave was not merged or cherry-picked. New hosts, destructive migrations/installers, unsafe Gemini flags, auth changes, telemetry changes, and unrelated generated churn were excluded.

Test Coverage

• 807 focused tests pass across host configuration, skill generation, and skill validation.
• bun run build passes.
• git diff --check passes.
• Codex-only, Claude-only, and no-agent auto-setup matrices pass in isolated HOME/PATH environments on macOS.

Live Evidence

Each accepted behavior used an immutable baseline plus separate candidate directories and HOME roots. The exact same production probe was run before and after across five isolated repositories:

• Hermes collision: 5 baseline failures → 5 candidate passes using real hermes skills list.
• Codex qa-only lookup: 5 baseline failures → 5 candidate passes by executing the actual generated lookup command.
• skill:check exclusion: 5 baseline failures → 5 candidate passes using the installed health command.

All three pr-test-env gates passed after the final code fingerprint.

Pre-Landing Review

The complete 50-PR wave was reviewed against each original PR diff. Only garrytan#1054, garrytan#1430, and garrytan#1772 were accepted. The exhaustive local verdict records all accepted, partial, dropped, duplicate, already-on-main, and human-signoff decisions.

Design Review

No frontend files changed — design review skipped.

Remaining Limits

• Availability matrices were run on macOS, not real Linux or Windows devices.
• Hermes evidence covers local discovery, not registry publication.
• Codex evidence covers generated skill lookup, not a complete external /ship operation.
• Windows-copy installers, auth/keychain flows, telemetry egress, safety hooks, migrations, and new hosts remain excluded pending their own realistic evidence.

Test plan

• bun test test/host-config.test.ts test/gen-skill-docs.test.ts test/skill-validation.test.ts — 807 pass, 0 fail
• bun run build
• Three five-repository baseline/candidate evidence gates
• Isolated Codex-only setup and generated qa-only read
• Isolated Claude-only setup with no Codex install
• Isolated no-agent setup fallback with no Codex install