Expose an audience-filtered skill catalog and completion HTTP API

[Aaronontheweb]

Outcome

First-party clients can discover visible skills and command hints.

Requirements

• Expose a bounded HTTP endpoint for the skill catalog.
• Support deterministic prefix completion.
• Return the unified invocable skill descriptor.
• Filter results by the caller audience.
• Include an argument hint when the source supplies one.
• Support local, skill-server, and MCP prompt sources.
• Return explicit errors for unavailable catalog state.
• Add authorization and contract tests.

Dependency

This issue depends on the unified descriptor issue.