Give bots skills: runbooks they load when a job matches

A skill is a runbook: a name, a unique slug, a one-line description of when
it applies, and the markdown body. A run only ever sees the slug and
description (one load_skill tool carries them), and reads the whole body
only when it calls the tool, so a long runbook costs nothing until needed.

Skills are the third extension kind beside MCP servers and custom tools, on
the same botExtensionsSql path, so per-bot, per-workspace and all-bots
grants work the same way, and attachDefaultExtensions hands an every-bot
skill to new bots. load_skill is a reserved tool name, so a custom tool
cannot shadow it, and a built-in wins a clash.

Managed on Settings > Skills; ExtensionRow links each kind to its own page
and a skill never reports a failure, since nothing connects or runs.

src/functions/backend/db/extensions/assert-bot-extension-manager.ts

@@ -8,7 +8,7 @@ type Params = {
 };
 
 /**
- * Throws unless the user manages this bot's MCP servers and tools: super
+ * Throws unless the user manages this bot's MCP servers, tools and skills: super
  * admins and admins, the super admin alone for the coordinator. Returns
  * the bot.
  */