feat(security): implement skill content scanning with shared prompt injection detection

[Aaronontheweb]

Summary

Closes #395

• RegexPromptInjectionDetector — shared regex engine in Netclaw.Security with 22 [GeneratedRegex] patterns across 5 threat categories (prompt injection, data exfiltration, privilege escalation, destructive ops, invisible unicode). Reusable by any content trust boundary via IPromptInjectionDetector.DetectAsync().
• RegexSkillContentScanner — trust-tier-aware adapter that delegates to the detector and applies policy: System/User bypass scanning, Community warns on medium/rejects high, External/Agent warns on low/rejects medium+.
• DI wiring fix — Program.cs was hardcoding new NoOpSkillContentScanner() instead of resolving from DI. Moved skill tool registration to post-build following the existing ChannelToolRegistration pattern.
• SkillManageTool — now passes SkillTrustTier through on create/edit/patch and surfaces Warning verdicts in tool response.

Risk matrix

Risk	Community	External/Agent
None	Allow	Allow
Low	Allow	Warn
Medium	Warn	Reject
High	Reject	Reject

Test plan

• 120 security tests pass (54 new across detector, scanner, DI, and no-op)
• 67 actor skill tests pass (existing, no regressions)
• Daemon builds clean
• dotnet slopwatch analyze — 0 violations

[Aaronontheweb]

Self-review

• Tightened the scanner boundary so malformed skills are no longer silently skipped: startup and sync now surface degraded inventory explicitly, and the registry tracks rejected skill issues instead of quietly dropping them.
• Closed the biggest bypasses in the original PR: skill_load, skill_read_resource, skill_manage patch, and resource-file write_file operations now run skill content scans, not just skill_manage write writes.
• Raised the effective scan policy for model-driven skill mutations to at least Community tier so agent-authored skill_manage create and skill_manage edit flows do not inherit the permissive User-tier bypass.
• Added frontmatter identity enforcement, duplicate-name rejection, canonical path and symlink checks, and staged system-skill sync replacement so partially unsafe feed updates do not replace the on-disk version.
• Added targeted tests for scanner issues, blocked malicious resource reads and writes, detector failure handling, and sync rollback behavior; targeted security, actors, and daemon test slices all passed locally after reconciliation.

Remaining caveat

• This is still a regex-based tripwire, not a full malicious-content or malware analysis system. It is materially harder to bypass now, but I still view it as an MVP guardrail for obvious prompt-injection, exfiltration, and privilege-escalation strings rather than a comprehensive skill security solution.