feat(knowledge-base): recognize Anthropic Skills layout for claude-code

[jonathansantilli]

Summary

Adds skill_paths entries for .claude/skills/*/SKILL.md (project + user scope) to the claude-code knowledge base, making Anthropic's Skills system a first-class artifact in CodeGate's discovery.

Why

Anthropic's Skills system stores each skill as <name>/SKILL.md under .claude/skills/, distinct from Claude Code's older custom-commands system (.claude/commands/**/*.md, already in the KB).

Before this change, when CodeGate walked a project or user-scope tree it did not match Anthropic skill files via the KB — the SKILL.md filename fell through to the generic regex in src/scan.ts:127, which tags the file as codex-cli. The file would still get scanned, but the discovery layer didn't recognize it as a claude-code artifact.

What changed

Two entries added to src/knowledge-base/claude-code.json:

{
  "path": ".claude/skills/*/SKILL.md",
  "scope": "project",
  "type": "anthropic_skill",
  "risk_surface": ["prompt_injection", "unicode_backdoor", "command_exec", "mcp_config"]
},
{
  "path": ".claude/skills/*/SKILL.md",
  "scope": "user",
  "type": "anthropic_skill",
  "risk_surface": ["prompt_injection", "unicode_backdoor", "command_exec", "mcp_config"]
}

Risk surface tokens chosen to mirror what Anthropic skills actually bundle:

• prompt_injection — SKILL.md is natural-language instructions the agent follows
• unicode_backdoor — steganographic payloads in headings or frontmatter
• command_exec — skills routinely ship shell scripts or curl | sh instructions
• mcp_config — skills can bundle .mcp.json or .claude/settings.json

Shape mirrors the existing .opencode/skills/**/*.md entry in opencode.json.

Test plan

• npm install && npm run build — builds cleanly
• npm test — existing KB tests (tests/layer1/knowledge-base.test.ts) still pass (they only assert tool presence, not path structure)
• Manual: codegate-ai scan <dir-containing-.claude/skills/foo/SKILL.md> — finding's affected_tools includes claude-code, path classification no longer falls back to the codex-cli regex
• Manual: codegate-ai scan <workspace> --include-user-scope — ~/.claude/skills/*/SKILL.md entries get picked up as user-scope artifacts

Notes

• Minimal addition — only the KB file changes. No code, no tests, no schema changes.
• The broader SKILL.md pattern in src/scan.ts:127 remains tagged as codex-cli for backwards compatibility with Codex skills that use the same filename at different paths. Multi-tool tagging is a larger refactor and intentionally out of scope.
• Patch-level version bump (0.12.4 → 0.12.5) is appropriate for release: content-only KB addition, no API or schema change.