Sanitize skill names in injection metrics (#34601)

## Why

Skill names may contain characters that are not valid in metric tag values.

## What changed

Pass skill names through `sanitize_metric_tag_value` before using them as the
`skill` tag on `codex.skill.injected` counters for both explicit and implicit
skill invocations.

GitOrigin-RevId: 0ed633fbd468739acc30193b566d830e20bc7860

codex-rs/core/src/skills.rs

@@ -6,6 +6,7 @@ use codex_analytics::SkillInvocation;
 use codex_analytics::build_track_events_context;
 use codex_extension_api::SkillInvocationInput;
 use codex_extension_api::SkillInvocationKind;
+use codex_otel::sanitize_metric_tag_value;
 use codex_protocol::protocol::SkillScope;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_plugins::PluginSkillRoot;
@@ -87,6 +88,7 @@ pub(crate) async fn maybe_emit_implicit_skill_invocation(
     if !inserted {
         return;
     }
+    let skill_name_tag = sanitize_metric_tag_value(skill_name.as_str());
 
     for contributor in sess.services.extensions.skill_invocation_contributors() {
         contributor
@@ -106,7 +108,7 @@ pub(crate) async fn maybe_emit_implicit_skill_invocation(
         /*inc*/ 1,
         &[
             ("status", "ok"),
-            ("skill", skill_name.as_str()),
+            ("skill", skill_name_tag.as_str()),
             ("invoke_type", "implicit"),
         ],
     );