feat(ai): add read-only user skill loader for SKILL.md

Refs: #9363

docs/content/docs/ai-assistant.cn.mdx

@@ -114,6 +114,14 @@ AI 上下文可以包含：
 
 模板会进入模型上下文，应避免放入密码、令牌或不必要的业务数据。规则冲突时，模型未必能按预期选择优先级，应保持全局指令和模板简短、明确且互不矛盾。
 
+
+## Skills（SKILL.md）
+
+Desktop 可以把只读的 [`SKILL.md`](https://developers.openai.com/codex/skills) 规则文件作为补充性指令附加到请求中。技能始终从 `~/.agents/skills` 发现；设置 → AI 中还可以额外启用一个自定义目录。两个目录独立校验，同名技能并列保留并标注来源（`默认目录` / `自定义目录`），自定义目录的技能排在前面。
+
+在输入区的 `Skills` 入口（或输入 `/skill`）选择技能，选中项以芯片形式显示在输入框上方，可随时移除。选择的生命周期是一个打开的 AI 面板：切换会话、新建会话都会保留；关闭面板或重启 DBX 即清空。选择不会持久化，DBX 也绝不写入技能文件。
+
+技能正文只在发送时从磁盘读取，并当场校验：文件被删除或不可读、frontmatter 无效、不是 UTF-8、超过单文件 1 MiB 上限、符号链接逃逸出所在目录，都会阻断发送，并在输入框上方显示横幅，标明失败的技能并提供重试、刷新、移除或打开设置等恢复操作。未选择任何技能时，提示词与既有行为逐字节一致。Web 端不提供该功能。
 ## 写入和生产安全
 
 AI Agent 的执行边界是后端强制的，不只是提示词：

docs/content/docs/ai-assistant.mdx

@@ -116,6 +116,14 @@ Templates can also be marked as the **default for one or more database types** (
 
 Templates enter model context. Do not put passwords, tokens, or unnecessary business data in them. Keep rules concise and non-conflicting because models may not resolve contradictory instructions as expected.
 
+
+## Skills (SKILL.md)
+
+Desktop can attach read-only [`SKILL.md`](https://developers.openai.com/codex/skills) rule files to a request as supplementary instructions. Skills are always discovered in `~/.agents/skills`; Settings → AI can additionally enable one custom directory. Each directory is validated independently, same names are kept side by side and labeled by source (`Default directory` / `Custom directory`), and custom-directory skills sort first.
+
+Select skills from the composer `Skills` entry (or type `/skill`) and remove them from the chips above the input. The selection lives for the lifetime of one open AI panel — conversation switches and new conversations keep it; closing the panel or restarting DBX clears it. Nothing is persisted, and DBX never writes to skill files.
+
+Skill bodies are read only when a request is sent, directly from disk, and validated then: file deleted or unreadable, invalid frontmatter, non-UTF-8 content, over the 1 MiB per-file limit, or a symlink escaping its root blocks the send with a banner above the composer naming the failed skill and offering Retry, Refresh, Remove, or Open Settings. With no skills selected, prompts are byte-for-byte identical to the pre-feature behavior. Web ships this feature unsupported.
 ## Writes and Production Safety
 
 AI Agent execution boundaries are enforced by the backend, not only by prompting: