Align shadow skill selection with observable sources (#32768)

## Why

Shadow selection can observe invocations from host and orchestrator skills, but
including executor skills in its candidates can skew the resulting metrics.

## What changed

Limit eligible shadow-selection candidates to enabled, prompt-visible skills
from host or orchestrator sources.

## Testing

Extend the implicit-invocation test to add matching executor candidates and
verify that the host skill remains the selected invocation hit.

GitOrigin-RevId: fd444fe27254b5a880ef5c03c29b5e195127cd97

codex-rs/ext/skills/src/shadow_selection_experiment.rs

@@ -10,6 +10,7 @@ use codex_otel::MetricsClient;
 use codex_protocol::user_input::UserInput;
 
 use crate::catalog::SkillCatalog;
+use crate::catalog::SkillSourceKind;
 use crate::dynamic_skill_selector::CheapSkillSelection;
 use crate::dynamic_skill_selector::CheapSkillSelector;
 use crate::dynamic_skill_selector::SkillSelectionDocument;
@@ -50,7 +51,16 @@ impl ShadowSelectionExperiment {
             .entries
             .iter()
             .enumerate()
-            .filter(|(_, entry)| entry.enabled && entry.prompt_visible)
+            .filter(|(_, entry)| {
+                entry.enabled
+                    && entry.prompt_visible
+                    // Invocation observation currently exists only for host shell use and
+                    // orchestrator reads. Keep the candidate set aligned with that universe.
+                    && matches!(
+                        &entry.authority.kind,
+                        SkillSourceKind::Host | SkillSourceKind::Orchestrator
+                    )
+            })
             .map(|(id, entry)| SkillSelectionDocument {
                 id,
                 name: entry.name.as_str(),