Load executor skills without host path conversion (#29626)

## Why

After #28918, selected skill roots are `PathUri`, but the executor skill
provider still converts them to the app-server host's `AbsolutePathBuf`.
A foreign Windows root therefore cannot be discovered by a Unix host,
and the inverse has the same problem.

This PR keeps executor skill discovery and reads on the filesystem that
owns the selected root while reusing the existing skill rules.

## What changed

- Generalize the existing skill traversal to operate on `PathUri`
through `ExecutorFileSystem`, preserving its depth, directory, symlink,
and sibling-metadata concurrency behavior.
- Add a small environment skill loader that reuses the shared discovery,
frontmatter validation, dependency parsing, product policy, and
prompt-visibility rules.
- Keep the environment id and entrypoint `PathUri` in the skill catalog,
then route `skills.read` back through the same environment filesystem.
- Preserve the executor's path convention when deriving catalog handles,
including literal backslashes in POSIX filenames.
- Resolve plugin namespaces from nearby manifests through URI-native
filesystem reads.
- Cover foreign Windows roots, executor-owned reads, namespaces,
metadata, policy, and path identity.

```text
selected root (PathUri)
        |
        v
shared discovery over ExecutorFileSystem
        |
        v
environment-bound catalog entry --skills.read--> same ExecutorFileSystem
```

No second filesystem abstraction or duplicate traversal implementation
is introduced.

## Stack

1. #29614 — add lexical `PathUri` containment.
2. #29620 — share URI-native manifest path resolution.
3. #28918 — keep selected plugin roots and resources URI-native.
4. **This PR** — load executor skills without host path conversion.
5. #29628 — resolve executor MCP working directories without host path
conversion.

codex-rs/ext/skills/src/provider/executor.rs

@@ -1,15 +1,11 @@
 use std::sync::Arc;
 
-use codex_core_skills::SkillMetadata;
-use codex_core_skills::filter_skill_load_outcome_for_product;
-use codex_core_skills::loader::SkillRoot;
-use codex_core_skills::loader::load_skills_from_roots;
+use codex_core_skills::loader::EnvironmentSkillMetadata;
+use codex_core_skills::loader::load_environment_skills_from_root;
 use codex_exec_server::EnvironmentManager;
 use codex_protocol::capabilities::CapabilityRootLocation;
 use codex_protocol::protocol::Product;
-use codex_protocol::protocol::SkillScope;
-use codex_utils_absolute_path::AbsolutePathBuf;
-use codex_utils_path_uri::PathUri;
+use codex_utils_path_uri::PathConvention;
 
 use crate::catalog::SkillAuthority;
 use crate::catalog::SkillCatalog;
@@ -64,42 +60,17 @@ impl SkillProvider for ExecutorSkillProvider {
                     ));
                     continue;
                 };
-                let root_path = match executor_absolute_path(&path) {
-                    Ok(root_path) => root_path,
-                    Err(err) => {
-                        catalog.warnings.push(format!(
-                            "Selected capability root `{selected_root_id}` has invalid path `{path}`: {err}"
-                        ));
-                        continue;
-                    }
-                };
                 let file_system = environment.get_filesystem();
-                let outcome = filter_skill_load_outcome_for_product(
-                    load_skills_from_roots(
-                        [SkillRoot {
-                            path: root_path.clone(),
-                            scope: SkillScope::User,
-                            file_system: Arc::clone(&file_system),
-                            plugin_id: None,
-                            plugin_namespace: None,
-                            plugin_root: None,
-                        }],
-                        /*plugin_skill_snapshots*/ None,
-                    )
-                    .await,
+                let outcome = load_environment_skills_from_root(
+                    file_system.as_ref(),
+                    &path,
                     self.restriction_product,
-                );
-                catalog.warnings.extend(outcome.errors.iter().map(|err| {
-                    format!(
-                        "Failed to load executor skill at {}: {}",
-                        err.path.display(),
-                        err.message
-                    )
-                }));
-                for (skill, enabled) in outcome.skills_with_enabled() {
+                )
+                .await;
+                catalog.warnings.extend(outcome.warnings);
+                for skill in outcome.skills {
                     catalog.push_entry(catalog_entry_from_skill(
-                        skill,
-                        enabled,
+                        &skill,
                         authority.clone(),
                         &selected_root_id,
                         &environment_id,
@@ -134,10 +105,9 @@ impl SkillProvider for ExecutorSkillProvider {
                     "executor skill resource references unavailable environment `{environment_id}`"
                 )));
             };
-            let resource_path = PathUri::from_abs_path(resource_path);
             let contents = environment
                 .get_filesystem()
-                .read_file_text(&resource_path, /*sandbox*/ None)
+                .read_file_text(resource_path, /*sandbox*/ None)
                 .await
                 .map_err(|err| {
                     SkillProviderError::new(format!(
@@ -159,19 +129,21 @@ impl SkillProvider for ExecutorSkillProvider {
 }
 
 fn catalog_entry_from_skill(
-    skill: &SkillMetadata,
-    enabled: bool,
+    skill: &EnvironmentSkillMetadata,
     authority: SkillAuthority,
     selected_root_id: &str,
     environment_id: &str,
 ) -> SkillCatalogEntry {
-    let skill_path = skill.path_to_skills_md.to_string_lossy().into_owned();
-    let normalized_path = skill_path.replace('\\', "/");
+    let skill_path = skill.path_to_skills_md.inferred_native_path_string();
+    let normalized_path = match skill.path_to_skills_md.infer_path_convention() {
+        Some(PathConvention::Windows) => skill_path.replace('\\', "/"),
+        Some(PathConvention::Posix) | None => skill_path,
+    };
     let display_path = format!(
         "skill://{selected_root_id}/{}",
         normalized_path.trim_start_matches('/')
     );
-    let mut entry = SkillCatalogEntry::new(
+    let entry = SkillCatalogEntry::new(
         SkillPackageId(display_path.clone()),
         authority,
         skill.name.clone(),
@@ -186,16 +158,9 @@ fn catalog_entry_from_skill(
     .with_display_path(display_path)
     .with_dependencies(skill.dependencies.clone());
 
-    if !enabled {
-        entry = entry.disabled();
+    if skill.allows_implicit_invocation() {
+        entry
+    } else {
+        entry.hidden_from_prompt()
     }
-    if !skill.allows_implicit_invocation() {
-        entry = entry.hidden_from_prompt();
-    }
-
-    entry
-}
-
-fn executor_absolute_path(path: &PathUri) -> std::io::Result<AbsolutePathBuf> {
-    path.to_abs_path()
 }