Trust invoked user skills in Guardian reviews (#41006)

## Why

Guardian treated all skill instructions as untrusted, so it could not use the
invocation of a user-owned skill as authorization evidence.

## What changed

- Record explicit and implicit skill invocations through extension contributors.
- Send Guardian a bounded, deduplicated list of canonical skill paths only when
  they resolve under the user's Codex or `.agents` skill directories.
- Keep repository skills and symlinks that escape trusted roots untrusted, and
  send only verified paths rather than skill contents to the classifier.
- Avoid recording host skill prompts that were superseded by core skill
  injection.

## Testing

- Added unit coverage for trusted roots, symlink escapes, deduplication, and
  size limits.
- Added integration coverage showing that Guardian trusts invoked user skills
  while rejecting a forged repository skill.

GitOrigin-RevId: 1cc0be230f7e6649110201c23c3de8f26447ff36

codex-rs/ext/skills/src/extension.rs

@@ -534,7 +534,7 @@ where
                         .filter(|host_skill| host_skill.name == entry.name)
                     {
                         injected_host_skill_prompts
-                            .insert_path(host_skill.path_to_skills_md.to_string_lossy());
+                            .insert_superseded_path(host_skill.path_to_skills_md.to_string_lossy());
                     }
                 }
             }

codex-rs/ext/skills/src/host_prompt.rs

@@ -15,6 +15,7 @@ use crate::render::truncate_main_prompt_contents;
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub struct InjectedHostSkillPrompts {
     paths: HashSet<String>,
+    superseded_paths: HashSet<String>,
 }
 
 impl InjectedHostSkillPrompts {
@@ -24,6 +25,13 @@ impl InjectedHostSkillPrompts {
         self.paths.insert(path);
     }
 
+    pub fn insert_superseded_path(&mut self, path: impl Into<String>) {
+        let path = path.into();
+        self.superseded_paths
+            .insert(normalize_host_skill_path(&path));
+        self.insert_path(path);
+    }
+
     pub fn is_empty(&self) -> bool {
         self.paths.is_empty()
     }
@@ -31,6 +39,11 @@ impl InjectedHostSkillPrompts {
     pub fn contains_path(&self, path: &str) -> bool {
         self.paths.contains(path) || self.paths.contains(&normalize_host_skill_path(path))
     }
+
+    pub fn is_superseded_path(&self, path: &str) -> bool {
+        self.superseded_paths
+            .contains(&normalize_host_skill_path(path))
+    }
 }
 
 /// Prompt fragments and read outcomes for a set of selected host skills.