fix(skills): stop a proactively-matched Quarantined skill from locking a turn's tools

[bug-ops]

Summary

A skill that merely scored above the matcher's similarity threshold for a turn — never explicitly invoked by the model — could drop the whole turn's effective_trust to Quarantined via the weakest-link fold in apply_skill_trust_and_gating, denying every bash/write/MCP tool call for the rest of the turn and every subagent spawned in it. Inversely, an explicit invoke_skill of a Quarantined skill returned its sanitized body without downgrading effective_trust for the remainder of the turn, contradicting the documented invariant.

Root causes and fixes (RC-1..RC-3, RC-5; RC-4 split out to #6702):

• RC-1: active_skill_names was assigned directly from the matcher's output with no trust filter. Agent::filter_active_skills_by_trust now drops Quarantined/Blocked matches from the active set before the fold runs, keeping them visible in the <other_skills> catalog (trust="quarantined"/"blocked" attribute) with a warning naming the promotion command (zeph skill trust <name> trusted).
• RC-2: retrieval-fallback mode (matcher unavailable/unconfigured) folded trust over the full, unscored registry even though only description-only text is injected in that mode. compute_effective_trust now forces Trusted whenever skill_fallback_mode is set.
• RC-3: SkillTrustGate::resolve_body refused only Blocked skills. invoke_skill/load_skill of a Quarantined skill now folds the new zeph_common::TurnTrustFloor (monotonic-downgrade-only) to Quarantined.
• RC-5: subagent spawn/resume applied an inherited trust cap via a plain set_effective_trust, which could restore trust above an already-lower floor. SpawnContext now carries a TurnTrustFloor handle and folds the inherited cap onto it when present. parent_effective_trust_level also reads the floor directly instead of recomputing, closing a fallback-mode regression (found during adversarial review) where a spawned subagent could be capped by the weakest trust level anywhere in the registry instead of the turn's actual enforced trust.

The weakest-link fold itself is unchanged as defense-in-depth for skills actually injected/invoked this turn, now a single shared helper used by both apply_skill_trust_and_gating and the subagent trust-cap computation.

RC-4 (AutoSkill draft-name collisions with native tool IDs) is tracked separately in #6702 and intentionally out of scope here.

Process notes

• Two adversarial-critique rounds: first verdict significant (found the fallback-mode subagent-cap regression above, plus a missed with_turn_trust_floor wiring gap in src/serve/agent_factory.rs, currently latent since serve wires no SubAgentManager); both fixed, second pass verdict approved.
• Code review independently re-ran the full CI-matching check suite from a cold rebuild and re-grepped all four entry points (runner.rs/daemon.rs/acp.rs/serve/agent_factory.rs) for correct wiring rather than trusting prior claims — verdict approved.
• Rebased onto origin/main after PR fix(skills): persist quarantined trust row for AutoSkill drafts at generation time #6705 (fix for AutoSkill trace-extraction drafts shadow native tool names and _quarantine/ has no effect on loading #6702) merged mid-review, touching the same skill_reload.rs file; auto-merged cleanly, full check suite re-run post-rebase.
• Known, accepted residual (not fixed here, follow-up issue recommended): the parent's TrustGateExecutor trust-floor atomic is shared, not isolated, across parent + all spawned subagents, so a fully independent concurrent write path outside SpawnContext is not covered by this fix.

Closes #6701

Test plan

• cargo +nightly fmt --check
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings
• cargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins (15304 passed, 0 failed, 36 skipped)
• RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features "desktop,ide,server,chat,pdf,scheduler"
• gitleaks protect --staged
• ~35 new unit/integration tests, including an end-to-end resolve_body(Quarantined) -> bash denied test and fresh-spawn + resume fold-never-raises subagent tests
• Live-session verification — not yet run, tracked in .local/testing/playbooks/trust-gate.md section 5 and .local/testing/coverage-status.md