Give bots skills: runbooks they load when a job matches

A skill is a runbook: a name, a unique slug, a one-line description of when
it applies, and the markdown body. A run only ever sees the slug and
description (one load_skill tool carries them), and reads the whole body
only when it calls the tool, so a long runbook costs nothing until needed.

Skills are the third extension kind beside MCP servers and custom tools, on
the same botExtensionsSql path, so per-bot, per-workspace and all-bots
grants work the same way, and attachDefaultExtensions hands an every-bot
skill to new bots. load_skill is a reserved tool name, so a custom tool
cannot shadow it, and a built-in wins a clash.

Managed on Settings > Skills; ExtensionRow links each kind to its own page
and a skill never reports a failure, since nothing connects or runs.

src/pages/api/admin/workspaces/add-extension.ts

@@ -7,6 +7,7 @@ import type { BotExtensionsPayload } from "@/src/types";
 import AppError from "@/src/utils/app-error";
 import parseWithSchema from "@/src/utils/parse-with-schema";
 import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import extensionNoun, { extensionLogTitle } from "@/src/utils/extension-noun";
 import safeErrorMessage from "@/src/utils/safe-error-message";
 import type {
     APIResponseObject,
@@ -37,10 +38,10 @@ export const handler: BunextAPIRouteHandler<APIResponseObject<BotExtensionsPaylo
         const { workspace, name } = await setWorkspaceExtension({ user_id: user.id, workspace_id, kind, id, attached: true });
 
         await logEvent({
-            title: "Workspace tool added",
+            title: extensionLogTitle({ kind, verb: "added" }),
             category: "system",
             user_id: user.id,
-            plain_text: `User #${user.id} gave ${kind == "mcp" ? "the MCP server" : "the tool"} ${name} to the workspace ${workspace.name} (#${workspace.id}).`,
+            plain_text: `User #${user.id} gave ${extensionNoun({ kind, article: true })} ${name} to the workspace ${workspace.name} (#${workspace.id}).`,
             metadata: { workspace_id, kind, id },
             ip_address: grabRequestIP(req),
         });