feat(pi): add external skill tools

[wutongyuonce]

Summary

Add the missing Pi tools for discovering, inspecting, and explicitly importing host-local External Skills:

• pc_external_scan → scan_external_skills
• pc_external_list → list_external_skills
• pc_external_resolve → resolve_external_skill
• pc_external_import → import_external_skill

Refs #1338.

Dependencies

Depends on #1621 and #1625. This PR should be reviewed and merged after both dependencies.

Plan and final design

The original plan was to close Pi's remaining External Skills capability gap while keeping discovery separate from durable import and execution.

The final design follows that plan:

1. pc_external_scan refreshes discovery and pc_external_list inspects discovered registrations. Both are read-only from Pi's operation policy.
2. pc_external_resolve requires the exact discovered external_skill_id and 64-character package fingerprint before import. Resolution is inspection only.
3. pc_external_import accepts only the exact identity, fingerprint, and import/fork mode. It is the only new mutating operation, so it requires interactive confirmation, refuses writes without a UI, injects the resolved Scope, and remains covered by secret filtering.
4. Tool schemas match the OpenAPI contract: closed objects, bounded identifiers, lowercase SHA-256 fingerprints, enum modes, and a nullable non-empty reason capped at 2000 characters.
5. The Pi guidance, project-context Skill, README, bilingual integration docs, manifest, and focused tests document the sequence and trust boundary. External Skill contents and locators remain untrusted; importing does not execute or publish a Skill.

This PR does not execute Skills, publish remote Skills, modify imported Skill contents, or promote Pi to Full by itself. The manifest deliberately keeps Pi at minimal, recommended and records the External Skills tool surface as deferred for profile accounting until #1621 and #1625 are merged. Full-profile promotion should be a follow-up after those dependencies land.

Verification

• Pi tests: 14 files, 94 tests passed
• Pi TypeScript typecheck passed
• Integration manifest tests: 28 passed
• Integration manifest documentation check passed
• Python typecheck (ty check) passed
• git diff --check passed

Review disclosure

Implemented and verified with Codex using GPT-5.6 Sol. A separate GPT-5.6 Luna review (medium reasoning) found one profile-accounting issue; it was fixed by deferring Full promotion until #1621 and #1625 are merged. The final Luna review was clean; Luna did not modify files or run formatters.