feat(skill): add standard package lifecycle and remote distribution

[Teingi]

Which issue or RFC does this PR close?

Closes #1397.

Implements the Standard Skill Package Lifecycle RFC:

• docs/en/rfcs/1351_standard_skill_package_lifecycle.md
• docs/zh/rfcs/1351_standard_skill_package_lifecycle.md

Rationale for this change

PowerContext can govern Experience and Skill revisions, but a useful Skill management loop also needs an authoritative package format, explicit local installation, and a secure way to distribute exact approved revisions to remote coding-agent machines. This change provides that end-to-end loop while keeping review, installation, execution, and remote credentials as separate trust boundaries.

What changes are included in this PR?

• Add the standard managed Skill package lifecycle: exact package capture and validation, immutable manifests and downloads, compatibility checks, lifecycle governance, usage evidence, provenance, and drift-safe publication.
• Publish the same reviewed package bytes to project-scoped Codex and Claude Code targets while retaining agent-specific installation roots and compatibility reporting.
• Add Receiver-pull remote distribution with one-time enrollment, credential-bound reconciliation and download, atomic installation, receipts, revocation, watch mode, and optional systemd user-service installation.
• Add persisted remote target and publication state for SQLite and OceanBase-compatible backends, including schema upgrades for existing databases.
• Extend the public OpenAPI contract, generated Python bindings, and generated DSH, Pi, and OpenCode operation tables.
• Add Dashboard workflows for local or remote delivery, machine naming/search/rename, origin badges, replacement-Skill selection, enrollment guidance, status refresh, and publish/unpublish actions.
• Add insecure-HTTP enrollment as an explicit opt-in for initial private-network deployments while keeping secure defaults and clear UI warnings.
• Update build artifacts so remote Receiver installation can use a wheel produced from the same checkout.
• Add English and Chinese RFC, configuration, and Server UI documentation; the RFC filename prefix now matches PR feat(skill): add standard package lifecycle and remote distribution #1351.
• Harden behavior found during real-host validation: use the configured generation timeout and a provider-compatible readiness token budget, preserve a venv-installed powercontext entrypoint in systemd units, return a lifecycle-specific 422 error for deprecated/retired publication, and support the latest OpenClaw's non-interactive pnpm and plugin-diagnostic behavior.

Are there any user-facing changes?

Yes. The Skills Dashboard now exposes governed package contents, provenance, lifecycle controls, local installation targets, and remote machine distribution. New CLI commands support enrollment, reconciliation, watch mode, and user-service installation. New HTTP operations and persistence tables/columns support package and distribution state.

Existing managed Skill revisions without a standard package remain visible but cannot be published until a package-backed revision is created or uploaded. Remote distribution is pull-based: the Server does not SSH into or directly write another machine. Package approval and publication do not grant runtime tool, network, filesystem, secret, or dependency-install authority.

How was this change tested?

Automated validation:

• make check
• make docs-test
• make contract-test (29 passed)
• Focused Python regression suite for the final fixes (89 passed)
• OpenClaw TypeScript plugin suite (16 passed)
• Full Python suite reached 1018 passed, 9 skipped; six Hermes tests were affected only by an existing repo-local .git/powercontext/codex-workspace.json workstream binding and passed (6 passed) when rerun with that local binding disabled.

Real scenario validation used the configured .env database and LLM without exposing credentials:

• Published, updated, drift-checked, and unpublished the same Skill package across local Codex and Claude Code targets.
• On an SSH-accessible second machine, completed Receiver enrollment, authenticated pull reconciliation, exact install/update/unpublish, delivery receipts, restart persistence, and cleanup.
• Upgraded OpenClaw to 2026.9.1-beta.1 and validated the real CLI, long-lived Gateway, plugin RPC, store/search/get/revise/retire, automatic recall, LLM-backed capture/flush, persistence after restart, and uninstall restoration.
• Through the upgraded OpenClaw Gateway, validated Skill V1 discovery/invocation, V2 publication to fresh sessions while an existing session retained its V1 snapshot, and unpublication from fresh discovery.

AI usage statement

OpenAI Codex (GPT-5) was used for design refinement, implementation, documentation, real-environment validation, defect diagnosis, and test execution. The resulting changes and validation evidence were reviewed before submission.