fix(core): reload changed skill sources - #40954

What

Hot reload local skill directory sources, including global and explicitly configured sources outside the active project.

Skill additions, edits, removals, and symlink target changes now invalidate the affected cached catalog and publish skill.updated without restarting the service or evicting the location.

Before / After

Before

1. A location loaded and cached skills from ~/.config/opencode/skills or another external source.
2. A skill was added, changed, or removed in that source.
3. The project filesystem watcher did not cover the external directory, so the skill cache remained stale.
4. The TUI continued showing the old catalog until the service restarted or the location was evicted.

After

1. Skill establishes source-owned watches before scanning a directory.
2. Logical and canonical source roots, including canonical directories behind symlinked skills, become cache dependencies.
3. A matching update removes the cached source and publishes skill.updated.
4. The next catalog read rescans the source and returns the current skills.

How

• packages/core/src/skill.ts follows the existing plugin watcher pattern: a local watch-once set plus the shared Watcher.subscribe service.
• Directory sources and downloaded URL source directories register scoped watches; the shared watcher continues deduplicating native subscriptions through its RcMap.
• Cache entries track both logical and canonical paths so symlink replacement and target edits invalidate the same source.
• Project filesystem events remain as a fallback for configured source paths whose parent directory does not exist yet.
• Source-state reloads clear cached contents before publishing the existing skill.updated read barrier.

Scope

• This PR does not change slash-command skill routing; that is a separate TUI bug and will be handled independently.
• Remote HTTP catalogs still refresh through their existing versioned download flow; this PR watches their downloaded local directories rather than polling remote origins.
• Watch registrations live for the location scope. The shared watcher deduplicates native subscriptions and releases them when the location closes.

Testing

• bun run test test/skill.test.ts test/filesystem/watcher.test.ts from packages/core (22 passed)
• OPENCODE_CONFIG_DIR=/private/var/folders/dd/5fz89drs5p9_r0fk7rwqqnbr0000gn/T/opencode/empty-config bun run test from packages/core (1,554 passed, 7 skipped)
• bun typecheck from packages/core
• Push hook: repository-wide bun turbo typecheck --concurrency=3 (32 packages passed)
• Prettier and git diff --check

Flow

sequenceDiagram
    participant Config as Skill source
    participant Skill as Skill service
    participant Watcher as Shared watcher
    participant Client as TUI/client

    Skill->>Watcher: subscribe to source
    Skill->>Config: scan and cache skills
    Config-->>Watcher: file added, changed, or removed
    Watcher->>Skill: filesystem update
    Skill->>Skill: invalidate matching cache entry
    Skill-->>Client: skill.updated
    Client->>Skill: refetch catalog
    Skill->>Config: rescan source