fix: restore --skills invoke override for harness

[notgitika]

Summary

• Restores the --skills CLI flag for agentcore invoke (harness only, preview-gated)
• Adds skills handling back to buildHarnessBaseOpts() so it's sent to the InvokeHarness API

This was a regression from the preview→main feature flag consolidation. The type field existed in InvokeOptions but was never wired to a CLI flag or action handler.

Test plan

• TypeScript compiles cleanly
• Lint/prettier pass
• Manual: agentcore invoke --harness X --skills ./path/to/skill sends skills in request body

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[github-actions]

Package Tarball

aws-agentcore-0.15.0.tgz

How to install

gh release download pr-1418-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.15.0.tgz

[agentcore-cli-automation]

Looks good to merge. The fix is small, focused, and follows the same pattern as the other harness override flags wired through buildHarnessBaseOpts (e.g. --tools, --allowed-tools):

• The CLI flag is correctly preview-gated alongside the other harness overrides in command.tsx.
• The { path: string } shape produced in buildHarnessBaseOpts matches the HarnessSkill interface in agentcore-harness.ts and the deploy-time mapSkills mapper, so wire format is consistent.
• Both invoke paths (handleHarnessInvokeByArn and the named-harness handler) route through buildHarnessBaseOpts, so the override applies in both cases.
• InvokeOptions.skills already existed in types.ts, confirming this was a wiring regression as described.

Telemetry-wise, this is consistent with the other harness override flags (none of --tools, --system-prompt, --allowed-tools, --max-iterations, etc. are individually tracked in InvokeAttrs), so no new telemetry is needed here.

One non-blocking note: the test plan still has "Manual: agentcore invoke --harness X --skills ./path/to/skill sends skills in request body" unchecked — worth running that end-to-end before merging to confirm the round-trip works.