feat(skills): add optional backend probing and command checks

[kshitijk4poor]

Summary

Follow-up to #1153 / original stacked follow-up from #723.

This finishes the remaining skill-readiness work by making prerequisite detection backend-aware.

Before this PR, skill readiness only reflected the current Python process and persisted local env state. That produced false setup_needed results in two important cases:

• local shells where a required env var or command is available through the user's login shell but not visible to the current process
• remote terminal backends where readiness needs to be evaluated inside the actual destination environment, not on the host

This PR adds shared probing helpers so skill readiness can report what is actually available in the environment where the skill will run.

What Changed

Skill prerequisite probing

• add shared probe helpers for required env vars and required commands without exposing secret values to agent context
• add local login-shell probing so skill_view() can detect prerequisites available through the user's real shell environment
• add remote backend probing through the terminal runtime path so docker / ssh / modal / daytona / singularity skills can report readiness against the destination environment
• add command prerequisite readiness metadata:
  • required_commands
  • missing_required_commands
• make setup_needed reflect both missing env vars and missing commands

Terminal / runtime plumbing

• extract shared environment acquisition into get_or_create_environment() so backend-aware helpers can reuse the same runtime boundary as terminal execution
• use the shared runtime helper from skills probing
• fix background terminal execution to inherit the environment cwd by default when no explicit workdir is passed

Shared runtime surface checks

• add tools/runtime.py with a shared is_gateway_surface() helper
• switch gateway/messaging checks in approval and cronjob gating to use the shared helper instead of duplicating env-var checks
• use the same helper for messaging-specific terminal sudo failure handling

Tests

• add regression coverage for:
  • command normalization / deduplication
  • local login-shell env probing
  • local login-shell command probing
  • remote backend readiness probing
  • command-missing readiness states
  • prompt-builder behavior on non-local backends so skill prompt construction does not boot a default sandbox
  • background terminal cwd fallback behavior

Why This Matters

This makes skill readiness much closer to the environment that will actually execute the skill:

• local skills can recognize prerequisites loaded by shell startup files
• remote/backend-bound skills no longer rely on host-side checks for readiness
• command prerequisites are surfaced explicitly instead of being invisible setup failures

In practice this should reduce false-positive setup prompts and make skill readiness metadata much easier to trust.

Test Results

• source .venv/bin/activate && python -m pytest tests/tools/test_skills_tool.py tests/tools/test_terminal_tool.py tests/agent/test_prompt_builder.py -q
• source .venv/bin/activate && python -m pytest tests/agent/test_skill_commands.py tests/test_run_agent.py tests/tools/test_registry.py -q

Follow-up to #688.

[teknium1]

Closing — the underlying problem this aimed to solve (skill prerequisites not being available in remote backends) has been addressed by credential file passthrough (#3671) and env var passthrough, which ensure secrets and environment variables are forwarded to docker/ssh/modal/etc at execution time rather than probing for their presence after the fact. The shared is_gateway_surface() consolidation is a nice cleanup but not worth the salvage effort given 1,355 commits of drift. Thanks for the thorough work on this!