feat(utils/scanner): add SkillRunner to scan agent skill bundles

[paralta]

This PR implements SkillRunner in utils/scanner, the counterpart to the existing MCPRunner, completing security scanning support for records that carry agent skill artifacts. The runner extracts the core/language_model/agentskills module from a record, unpacks it via exportfmt.ExtractSkillBundleArchive, and runs skill-scanner scan to produce a ScanResult with per-finding severity. SKILL_SCANNER_LLM_* environment variables are derived automatically from the AZURE_OPENAI_* equivalents so CI doesn't need duplicate config.

• ExtractSkillBundleArchive is extended to transparently handle both gzip-tar bundles and plain-text SKILL.md manifests via a magic-byte check, eliminating format-detection logic from the scanner itself.
• utils/go.mod switches from the pinned api v1.5.0 to a local replace directive so the scanner can use the updated exportfmt package before a new tag is cut.
• trimToSkillJSON looks for either { or [ as the JSON start, unlike the MCP equivalent which only accepts arrays — skill-scanner's single-scan mode emits a top-level object.
• Safety verdict is taken directly from the scanner's is_safe field; findings are always surfaced regardless of that verdict so callers have full context.

[codecov]

Codecov Report

❌ Patch coverage is 68.46847% with 35 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
utils/scanner/skill.go	69.2%	31 Missing and 2 partials ⚠️
api/exportfmt/skill_bundle_extract.go	50.0%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[ramizpolic]

LGTM