Skill registry: detect cross-source name conflicts instead of silently skipping #11141

Discovered while researching the cross-agent skill-manager pattern (yibie/skills-manager) against our own skills platform.

Problem

SkillRegistry.register() in autobot-backend/skills/registry.py:42 silently drops a skill when its name is already taken:

if name in self._skills:
    logger.warning("Skill '%s' already registered, skipping", name)
    return

We import skills from multiple independent sources — builtin Python modules, SKILL.md-only declaratives (discover_builtin_skills Pass 2), external git/http repos (external_importer.py), the community hub (hub.py), and the sync backends (skills/sync/: git/local/mcp). When two sources define the same skill name with different content/version/trust-level, the current behavior is first-write-wins + a warning — no visibility into which source shadowed which, and no way for an operator to resolve it.

This is the same gap the cross-agent tools call out as "skill conflict detection across sources" (their roadmap).

Impact

• A sandboxed external import silently masked by (or silently masking) a trusted builtin of the same name — a trust-boundary surprise.
• Version drift between sources is invisible; whichever registers first wins non-deterministically depending on discovery order.

Proposed change

At register() (and the Pass-2 skip at registry.py:311), when a name collision occurs:

1. Compare version, source, and trust_level of incumbent vs. incoming.
2. If they differ, record a structured conflict (name, both sources, both versions, both trust levels) rather than a bare warning.
3. Surface conflicts via the skills health/status path (mirror the content_reach/registry.py register_chain + probe model, which already tracks per-backend state) so SkillsView.vue can show them.
4. Keep a deterministic resolution rule (e.g. trusted builtin always wins over sandboxed import) instead of discovery-order-wins.

Notes

• Closest existing pattern to copy: autobot-backend/content_reach/registry.py (register_chain, probe-cached liveness, per-backend circuit breaker).
• Do not weaken the import security model — sandboxed/external skills must never auto-win over a builtin/trusted skill on conflict.
• Source: /research on yibie/skills-manager, Phase 2 comparison.