feat: add skills extension scaffold (#25953)

## Disclaimer
This is only here for iteration purpose! Do not make any code rely on
this

## Why

Skills still live behind `codex-core` discovery and injection paths, but
the extension system needs an authority-aware home before that logic can
move. This adds that boundary without changing current skills behavior,
and keeps host, executor, and remote skills distinct so future
list/read/search flows do not collapse back to ambient local paths.

## What changed

- Add the `codex-skills-extension` workspace/Bazel crate under
`ext/skills`.
- Define the initial catalog, authority, provider, and turn-state types
for authority-bound skill packages and resources.
- Register placeholder thread/config/prompt/turn lifecycle contributors
plus host, executor, and remote provider aggregation points.
- Capture the remaining extraction work as TODOs, including the missing
extension API hooks needed for per-turn catalog construction and typed
skill injection.
- Keep plugins outside the runtime skills model: plugin-installed skills
are treated as materialized host-owned skill sources once available.

## Verification

- Not run locally.

codex-rs/ext/skills/src/provider.rs

@@ -0,0 +1,63 @@
+use std::future::Future;
+
+use crate::catalog::SkillAuthority;
+use crate::catalog::SkillCatalog;
+use crate::catalog::SkillPackageId;
+use crate::catalog::SkillProviderResult;
+use crate::catalog::SkillReadResult;
+use crate::catalog::SkillResourceId;
+use crate::catalog::SkillSearchResult;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SkillListQuery {
+    pub turn_id: String,
+    pub executor_authorities: Vec<SkillAuthority>,
+    pub include_host_skills: bool,
+    pub include_remote_skills: bool,
+}
+
+impl SkillListQuery {
+    pub(crate) fn placeholder_for_turn(turn_id: &str) -> Self {
+        Self {
+            turn_id: turn_id.to_string(),
+            executor_authorities: Vec::new(),
+            include_host_skills: true,
+            include_remote_skills: true,
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SkillReadRequest {
+    pub authority: SkillAuthority,
+    pub resource: SkillResourceId,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SkillSearchRequest {
+    pub authority: SkillAuthority,
+    pub package: SkillPackageId,
+    pub query: String,
+}
+
+/// Source-specific skill catalog and resource access.
+///
+/// Implementations must preserve authority boundaries: a resource listed by a
+/// provider must be read or searched through the same provider/authority rather
+/// than converted into an ambient local path.
+pub trait SkillProvider: Send + Sync {
+    fn list(
+        &self,
+        query: SkillListQuery,
+    ) -> impl Future<Output = SkillProviderResult<SkillCatalog>> + Send;
+
+    fn read(
+        &self,
+        request: SkillReadRequest,
+    ) -> impl Future<Output = SkillProviderResult<SkillReadResult>> + Send;
+
+    fn search(
+        &self,
+        request: SkillSearchRequest,
+    ) -> impl Future<Output = SkillProviderResult<SkillSearchResult>> + Send;
+}