feat(profile): v0.6.1 — Project Isolation (activation policy)

[g761007]

Summary

• Add ActivationPolicy model to manifest/models.py with 4 modes: strict, merge, fallback, manual
• Skillfile gains activation: field (default: manual + inherit_global=true → zero breaking change from v0.6.0)
• compose_effective_skillset() applies the policy via _apply_activation_policy(); EffectiveSkillset gains warnings: tuple[str, ...] surfaced to CLI stderr
• New LayerOrigin values: GLOBAL_PROFILE_FILTER, POLICY_BLOCKED_GLOBAL
• resolve and status gain --ignore-global flag
• status output shows activation: <mode> / inherit_global=<bool> line
• 25 new tests (348 total, all green on Linux/macOS; Windows 3.12 failure is pre-existing on main)

Mode semantics

Mode	No --profile	With --profile X
strict	base only (or default_profile from project)	project profile only; global → stderr warning + exit 1
merge	auto-apply default_profile (project ∪ global)	project ∪ global union
fallback	auto-apply default_profile: project first, else global	project first, else global
manual	base only	v0.6.0 behaviour: project first, else global

Out of scope (deferred)

• --ignore-global for install / sync (requires migrating pipeline.py / sync.py call sites from flatten() to compose_effective_skillset())
• v0.6.2 Safe Switching (switch command, 3-scope active profile state)

Test plan

• uv run pytest -q — 348 passed, 1 skipped
• uv run mypy src/skillpod — clean
• uv run ruff check src tests — clean
• skillpod status shows activation: line
• skillpod resolve --ignore-global skips global profiles
• activation: {mode: strict} rejects global profile with exit 1 + stderr warning