🪜 chore: Plumb allowedTools through resolveManualSkills

[danny-avila]

Summary

Tiny shape-only precursor shared by Phase 5 (always-apply frontmatter) and Phase 6 (frontmatter runtime enforcement). Lands first to eliminate the type-shape race between the two phases so they can proceed in parallel.

• Adds allowedTools?: string[] to ResolvedManualSkill.
• Widens the getSkillByName return type in ResolveManualSkillsParams and InitializeAgentDbMethods to carry the same field.
• resolveManualSkills forwards skill.allowedTools verbatim when present; absent otherwise.

No runtime behavior change. The field is populated from the skill doc but not yet consumed by any downstream code path. Phase 6 will union the per-skill allowlist into the agent's effective tool set for the turn; Phase 5's ResolvedAlwaysApplySkill will mirror this exact shape.

Scoped intentionally small:

• Three files, 65 additions, one deletion.
• No schema change — Phase 6 owns the structured column (skill.allowedTools) and the frontmatter importer mapping.
• No changes to injectManualSkillPrimes, call sites in initialize.ts, or JS controllers — downstream consumers only read name and body.

Why a precursor

From the umbrella rollout plan: Phase 5 and Phase 6 both need ResolvedManualSkill.allowedTools in their resolver pipeline. Landing the shape here means neither phase has to own the interface addition, and merge conflicts between their branches stay textual.

Test plan

• resolveManualSkills forwards allowedTools when the skill doc declares it.
• resolveManualSkills omits allowedTools when the field is absent (no spurious key on the resolved object).
• resolveManualSkills preserves an empty allowedTools: [] array (distinguishes "explicitly declared none" from "undeclared" for Phase 6 semantics).
• All 78 existing skills.test.ts tests pass unchanged.
• All 14 existing initialize.test.ts tests pass unchanged.
• tsc --noEmit clean.
• ESLint clean on the three changed files.

Base branch

Targets feat/agent-skills (umbrella PR #12625), not dev.