feat: preserve workspace instruction and skill intent

[limityan]

Problem

BitFun already discovers workspace instruction files and external Skill roots, but two source-owned semantics were lost on the production path:

• Workspace instructions were read from the local disk only, so Remote workspaces did not receive them and AGENTS.override.md precedence was not preserved.
• Skills stayed explicitly usable, but Claude/Codex declarations that prohibit model-initiated invocation were discarded before the model-facing catalog was built.

This PR implements only contracts that current competitors expose: Codex project instruction precedence, Codex Skill invocation policy, and Claude Skill invocation controls.

Changes

Workspace Instructions owner

• Resolve root-level instructions through the active WorkspaceFileSystem for both local and Remote workspaces.
• Match Codex runtime precedence: an existing AGENTS.override.md selects that candidate even when empty; AGENTS.md is not reintroduced.
• Keep CLAUDE.md as an independent existing source in the established order.
• Resolve instruction files only on a user-context cache miss and only when the Agent policy requests WorkspaceInstructions.
• Cache successful empty results, but do not cache transient file-system failures or a temporarily unavailable Remote workspace provider; the next scaffold retries.
• Preserve a resolved-state fact so PromptBuilder does not rescan local disk after the workspace provider has resolved the current turn.

Skill invocation-intent owner

• Preserve Claude disable-model-invocation, including its documented Boolean aliases.
• Read Codex agents/openai.yaml only for policy.allow_implicit_invocation and merge restrictions monotonically; a permissive declaration cannot relax an existing restriction.
• Filter only model-facing Skill catalogs: prompt XML, turn snapshots, and DeepReview capabilities.
• Revalidate DeepReview's current implicit-invocation policy before loading a model-selected stable key, while retaining the original explicit Skill loader.
• Keep explicit Skill loading, CLI /skills, mode configuration, and existing UI contracts unchanged.

Boundaries

• No root-to-cwd instruction cascade, global instruction source, Claude imports/rules, OpenCode glob/URL instructions, watcher, conflict report, or new selector/UI.
• No new Skill roots, source-global enablement policy, URL loading, automatic refresh, permission model, or host runtime.
• No new cache layer, invalidation protocol, runtime owner, or lifecycle event.
• The two behaviors retain independent owners and are combined only as one delivery PR.

Verification

• cargo check --workspace
• cargo test -p bitfun-agent-runtime --test skill_contracts (17 passed)
• cargo test -p bitfun-services-core workspace_instruction -- --nocapture (2 passed)
• cargo test -p bitfun-services-core --features workspace-runtime --test workspace_instruction_contracts (1 passed)
• focused bitfun-core local/Remote Codex policy tests (2 passed)
• focused bitfun-core Remote and resolved-empty PromptBuilder tests (2 passed)
• post-rebase cargo test -p bitfun-core instruction --lib (7 passed)
• focused Remote missing-provider no-cache test (1 passed)
• focused DeepReview catalog-to-resolve policy-change test (1 passed)
• node scripts/check-core-boundaries.mjs
• pnpm run check:repo-hygiene
• git diff --check

Context-isolated adversarial review rounds found and closed Boolean compatibility, empty-override precedence, PromptBuilder owner ambiguity, eager Remote IO, transient-failure cache pollution, missing Remote-provider cache pollution, and DeepReview policy revalidation gaps. The final review was repeated after rebasing to e528e859 and found no P0/P1/P2 issues.