feat: fix skills discovery, tool rendering, and add tier 2 tools

[avoidwork]

Description

Fixes skills_list tool rendering (double-JSON-encoding bug), adds SKILL.md-only skill discovery fallback, updates system prompt to guide agent to call skills_list, and wires up tier 2 tools (web_search, vision_analyze, image_generate, execute_code, cronjob) with permission/API key gating.

Type of Change

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Testing

• All 409 tests pass with 100% line coverage
• New discoverer tests verify both yaml/json metadata and SKILL.md-only skill discovery
• Tool registration tests verify tier 1 and tier 2 tools register correctly with permission gating
• Pre-commit hook runs lint (oxlint/oxfmt) and tests before committing

Coverage

• 100% line coverage maintained

Checklist

• npm run lint passes
• Tests pass with 100% line coverage
• No forbidden patterns used
• Conventional Commit style applied

Threat Model Considerations

• Tier 2 tools gated by API keys and permissions (network:outbound for web/cron, OPENAI_API_KEY for vision, FAL_API_KEY for image)
• SKILL.md fallback discovery does not execute arbitrary code — only reads metadata
• skills_list/skill_view tools require filesystem:read permission