Explain why each skill is available or blocked

Empieza siguiendo el comando existente intent list y sus rutas de salida humana y JSON, y después revisa la dependencia #219 para consultar el formulario de políticas por skill. Define la superficie de diagnóstico explícita final antes de la implementación, manteniendo sin cambios la salida normal y conservando la redacción para agentes. Se considera terminado cuando los criterios de aceptación distinguen cada resultado de política listado, las exclusiones, las entradas no descubiertas y el comportamiento de revisión oculta.

Problem

intent list shows available skills and can show hidden source summaries, but it does not identify the exact policy decision that made a package or skill available or blocked. Consumers must reconstruct the result from inherited intent.skills, wildcard matching, source kind, and intent.exclude rules.

User outcome

A human can inspect a skill-level diagnostic in human-readable or JSON form and understand why each relevant skill is available, blocked, or not discovered.

In scope

• Add an opt-in human-readable explanation mode for intent list, proposed as intent list --why.
• Add corresponding structured JSON fields with stable decision categories.
• Identify the controlling policy result for explicit package permission, wildcard permission, allow-all mode, absent migration mode, empty deny-all mode, package exclusion, skill exclusion, package not listed, source-kind mismatch, and configured-but-not-discovered entries.
• Add per-skill permission explanations after #219 defines that policy form.
• Report exclusion as the controlling result when a discovered package is both excluded and not listed; preserve the current suppression of the unlisted-source notice for explicitly excluded packages.
• Include the configuration file that owns the effective inherited intent.skills declaration in human explanation output when available.
• Preserve normal intent list output when explanation mode is not requested, including the existing human notice that names unlisted packages.
• Use intent list --why --show-hidden for detailed human review of hidden package and skill identities; --why without --show-hidden does not add hidden identities beyond the existing notice.
• Preserve agent redaction regardless of flags: agent sessions receive hidden counts and reasons without hidden package, skill, path, or source identities.

Out of scope

• Changing permission semantics.
• Content hashes, byte drift, or lockfile state.
• Delivery, placement, hook execution, or synchronization state.
• Git source implementation.

Acceptance criteria

Package-level explanations

• Human-readable explanation output identifies why each listed skill is available under the current package-level policy.
• intent list --why --show-hidden identifies why each human-reviewed hidden or excluded candidate is blocked.
• JSON explanation output identifies the package, skill when known, availability result, and stable controlling decision category.
• Output distinguishes explicit package permission, wildcard permission, allow-all mode, absent migration mode, and empty deny-all mode.
• Output distinguishes package exclusion, skill exclusion, package-not-listed, and source-kind-mismatch results.
• Exclusion is reported as the controlling result when it removes a package or skill, including a package that is also not listed.
• Configured packages that were not discovered use "not discovered" language rather than claiming they are not installed.
• Human explanation output includes the effective intent.skills configuration path when available.
• Normal human and JSON output remain compatible when explanation mode is not requested.
• The existing default human notice for unlisted packages remains unchanged.
• --why without --show-hidden does not add hidden package, skill, path, or source identities beyond the existing human notice.
• Agent sessions do not receive hidden package names, skill names, paths, or source identities, even when explanation or hidden-review flags are passed.
• Source-kind-mismatch details are available only in explicit human hidden review.
• The diagnostic does not report content, byte, lockfile, or delivery state.

Per-skill explanations

• After #219 is complete, output distinguishes an explicit per-skill permission from a package-level permission.
• After #219 is complete, configured skills that were not discovered use "not discovered" language.

Dependencies

• #219 for the two per-skill explanation criteria. Package-level explanations can ship independently.

Open decision

Confirm whether intent list --why is the final surface or whether the explanation belongs in another explicit diagnostic mode. The default intent list output must remain concise either way.