Instructree v0.15.0 — explain Codex skill configuration

Explain why Codex skills are disabled

Codex can discover a skill on disk while user configuration still disables it. Instructree now makes that supported user-level configuration visible in the same read-only skill audit.

What's new

• Read supported [skills], [skills.bundled], and [[skills.config]] settings from user ~/.codex/config.toml.
• Apply exact name/path selectors and later-rule precedence to every discovered candidate.
• Report disabled candidates, unmatched rules, catalog injection, bundled-skill state, and max_context_tokens in JSON and human output.
• Redact absolute path selectors and fail closed when relevant syntax is outside the supported subset; no partial rules are applied.
• Deliberately exclude project skill rules because current Codex main loads these rules from user and session layers, not project configuration.

This targets recurring Codex configuration/discovery confusion documented in #37242, #20210, #24237, and #29846. The implementation is grounded in the pinned Codex configuration source.

Verification

• 63 tests across Node.js 20, 22, and 24 on Linux, macOS, and Windows.
• Hosted CI, code scanning, and GitHub Pages passed on commit 898823b725493a302745148caccbf0487caf8eac.
• Arbor development and fresh packed held-out evaluations both scored 100/100.
• Exact 22-file package installed and passed a configuration fixture with no absolute-path leakage.
• SHA-256: 3d9f75241c21bd07604fd8ebbac1af98e04abea66437d012f3fb70dc4f943a46.