fix(skills): wire trust config and RL routing head into ACP/serve/daemon

[bug-ops]

Summary

• AgentBuilder::with_trust_config and the skill-trust-DB seeding step were CLI-only (src/runner.rs). Agents built via daemon.rs, acp.rs, or /sessions (serve/agent_factory.rs) left services.skill.trust_config at its default and never seeded fresh skills into the trust DB, so any skill without a prior row fell back to SkillTrustLevel::MISSING_ENTRY_FALLBACK (Trusted, fail-open) instead of the operator's configured [skills.trust] policy — a hash_mismatch_level = "blocked" tightening, for example, was silently ignored for these three entry points.
• AgentBuilder::with_rl_head/with_rl_routing (the SkillOrchestra REINFORCE-trained re-ranking head) were wired only into runner.rs/daemon.rs; ACP and /sessions agents always fell back to pure-cosine skill matching regardless of persisted RL weights.
• Extracted the trust-DB seeding block into a shared AppBuilder::seed_skill_trust_db helper called from all four construction paths, and wired .with_trust_config(...) into every one of them. Mirrored daemon.rs's RL head load-or-cold-start logic into acp.rs and serve/agent_factory.rs.

Closes #5920, closes #5921.

Follow-ups filed during review (not blocking this fix):

• SkillOrchestra RL routing head loses updates under concurrent ACP/serve sessions #5974 — routing_head_weights is a single global row; concurrent RL-enabled ACP/serve sessions can lose each other's updates (last-write-wins). Bounded by rl_routing_enabled defaulting to false; documented at both RL wiring call sites.
• SkillInvokeExecutor (invoke_skill tool) never wired into ACP or daemon agent-construction paths #5975 — SkillInvokeExecutor (the invoke_skill tool's per-invocation trust re-check) remains CLI-only; confirmed this does not make this fix inert since context assembly still gates on trust rows in every path.
• extract shared Agent skill-config builder chain duplicated across runner/daemon/acp/serve #5887 (pre-existing, referenced not filed) — tracks extracting a shared build_acp_agent-style helper; spawn_acp_agent has no return seam today, so the ACP wiring is covered by a deps-level test rather than a real Agent-level regression test.

Test plan

• cargo +nightly fmt --check
• cargo clippy --profile ci -p zeph -p zeph-core --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings
• cargo check --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" (post-rebase sanity)
• Targeted nextest (acp/daemon/serve/bootstrap modules): 174/174 pass, including 4 new/extended regression tests
• zeph-core session_config/trust/skills tests: 39/39 pass
• Full workspace nextest --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins: 12625/12625 pass
• cargo test --doc -p zeph-core: 38 passed
• rustdoc gate clean on touched crates
• Live-session verification — playbook at .local/testing/playbooks/skill-trust-rl-wiring.md (scenarios A-F), tracked as Untested in .local/testing/coverage-status.md pending a live CI cycle