v1.6.0a3

What's Changed

• feat(sse): reconnect-with-replay foundation (PR-D for issue #540) by @eous in #542
• feat(auth): model.skills.write permission + user_has_permission helper by @eous in #547
• feat(skills): unify skill + list_skills into action-multiplexed tool by @eous in #555
• fix(ui): renderer local-escape + attribute-context CI lint by @eous in #556
• refactor(skills): flatten SkillKind enforcement at tool / HTTP layer by @eous in #558
• fix(sse): address PR #542 review findings (truncated dedup, lock scope, doc, coord dead-code) by @eous in #561

Full Changelog: v1.6.0a2...v1.6.0a3