Trust invoked user skills in Guardian reviews (#41006)

## Why

Guardian treated all skill instructions as untrusted, so it could not use the
invocation of a user-owned skill as authorization evidence.

## What changed

- Record explicit and implicit skill invocations through extension contributors.
- Send Guardian a bounded, deduplicated list of canonical skill paths only when
  they resolve under the user's Codex or `.agents` skill directories.
- Keep repository skills and symlinks that escape trusted roots untrusted, and
  send only verified paths rather than skill contents to the classifier.
- Avoid recording host skill prompts that were superseded by core skill
  injection.

## Testing

- Added unit coverage for trusted roots, symlink escapes, deduplication, and
  size limits.
- Added integration coverage showing that Guardian trusts invoked user skills
  while rejecting a forged repository skill.

GitOrigin-RevId: 1cc0be230f7e6649110201c23c3de8f26447ff36

codex-rs/core/src/session/turn.rs

@@ -845,7 +845,8 @@ async fn build_skills_and_plugins(
         &mentioned_skills,
         &injected_host_skills,
         tracking.clone(),
-    );
+    )
+    .await;
     for message in host_skill_warnings {
         sess.send_event(turn_context, EventMsg::Warning(WarningEvent { message }))
             .await;