feat(tasks): bundle local skills for cloud runs

[tatoalo]

Problem

for cloud tasks, local skill invocations only sent the slash command text. User-local and repo-local skills were available in the local editor but not in the cloud sandbox

Changes

• let's bundle uploadable local skills into zip artifacts with SHA-256 metadata and send them through the existing cloud artifact upload flow.

• install skill_bundle artifacts in the agent server before prompt delivery, inject the bundled skill instructions for the invoked turn, and suppress the raw slash command from the model-facing prompt so local skills behave like actual skills rather than unsupported commands

• refresh slash command metadata when a follow-up command is submitted, so newly created local skills can be selected and invoked without starting a brand-new task.

closes #2260

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 9a1a7aa.}

[greptile-apps]

Comments Outside Diff (1)

1. packages/core/src/sessions/sessionEvents.ts, line 17-42 (link)

   decodeXmlAttr is a local reimplementation of unescapeXmlAttr already exported from @posthog/shared. Three other files that parse skill tags in this PR (content.ts, cloudPrompt.ts, cloud-prompt.ts) all import unescapeXmlAttr from @posthog/shared. This local copy is a direct violation of OnceAndOnlyOnce and drifts silently if the shared version is ever updated.

   Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

_{Reviews (1): Last reviewed commit: "fix(tasks): update queued cloud prompt t..." | Re-trigger Greptile}

[tatoalo]

Superseded by a stacked split for easier review (same change, rebased onto current main):

• feat(tasks): add skill bundle artifact contracts and metadata types #2922 — contracts & metadata types
• feat(tasks): bundle local skills into sha256-verified zip artifacts #2923 — local skill bundler (+ tRPC route)
• feat(tasks): install and apply skill bundle artifacts in the sandbox #2924 — sandbox install/extract/apply
• feat(tasks): route local skill tags through the cloud prompt pipeline #2925 — cloud prompt plumbing
• feat(tasks): surface local skills in the composer and upload on send #2926 — composer integration & DI wiring

Closing in favour of the stack.