#23802: Skills: add trusted publisher allowlist policy

## Summary - add `skills.trustedPublishers` allowlist policy for verified skill signatures - block unsigned/unknown-publisher skills when trusted publishers are configured - accept either signature `publisher` or `keyId` matches (case-insensitive) - add config validation + policy tests ## Why This enables explicit publisher trust control so “signed” is not enough by itself; signatures must map to trusted identities. ## Tests - `pnpm vitest run src/agents/skills/signature.test.ts src/agents/skills/config.trusted-publishers.test.ts src/agents/skills.test.ts src/config/config.skills-trusted-publishers.test.ts` - `pnpm lint` <!-- greptile_comment --> <h3>Greptile Summary</h3> This PR adds a `skills.trustedPublishers` allowlist policy to enforce explicit publisher trust control for verified skill signatures. The implementation introduces signature verification using ed25519, blocking unsigned or unknown-publisher skills when the allowlist is configured. **Key changes:** - New signature verification module (`signature.ts`) that validates ed25519 signatures on skill directories - Skills with invalid signatures are quarantined and excluded from the skill snapshot - `shouldIncludeSkill` enforces the allowlist policy with case-insensitive matching on both `publisher` and `keyId` fields - Configuration schema extended with `skills.trustedPublishers` array - Comprehensive test coverage for signature verification, policy enforcement, and config validation <h3>Confidence Score: 5/5</h3> - This PR is safe to merge with minimal risk - The implementation is well-structured with comprehensive test coverage including signature verification, policy enforcement, and config validation. The code follows TypeScript best practices with proper error handling, the signature verification uses standard crypto primitives correctly, and invalid signatures are safely quarantined. No logical errors or security issues were found. - No files require special attention _{Last reviewed commit: a70f308} <!-- greptile_other_comments_section --> <!-- /greptile_comment -->