Explain why each skill is available or blocked

Bắt đầu bằng cách lần theo lệnh hiện có intent list và các đường dẫn đầu ra cho người dùng và JSON, sau đó xem xét dependency #219 để biết biểu mẫu policy theo từng skill. Xác định bề mặt chẩn đoán tường minh cuối cùng trước khi triển khai, giữ nguyên đầu ra thông thường và bảo toàn việc che thông tin cho agent. Được xem là hoàn tất khi các tiêu chí chấp nhận phân biệt từng kết quả policy được liệt kê, các mục loại trừ, các mục chưa được phát hiện và hành vi của quá trình xem xét bị ẩn.

Problem

intent list shows available skills and can show hidden source summaries, but it does not identify the exact policy decision that made a package or skill available or blocked. Consumers must reconstruct the result from inherited intent.skills, wildcard matching, source kind, and intent.exclude rules.

User outcome

A human can inspect a skill-level diagnostic in human-readable or JSON form and understand why each relevant skill is available, blocked, or not discovered.

In scope

• Add an opt-in human-readable explanation mode for intent list, proposed as intent list --why.
• Add corresponding structured JSON fields with stable decision categories.
• Identify the controlling policy result for explicit package permission, wildcard permission, allow-all mode, absent migration mode, empty deny-all mode, package exclusion, skill exclusion, package not listed, source-kind mismatch, and configured-but-not-discovered entries.
• Add per-skill permission explanations after #219 defines that policy form.
• Report exclusion as the controlling result when a discovered package is both excluded and not listed; preserve the current suppression of the unlisted-source notice for explicitly excluded packages.
• Include the configuration file that owns the effective inherited intent.skills declaration in human explanation output when available.
• Preserve normal intent list output when explanation mode is not requested, including the existing human notice that names unlisted packages.
• Use intent list --why --show-hidden for detailed human review of hidden package and skill identities; --why without --show-hidden does not add hidden identities beyond the existing notice.
• Preserve agent redaction regardless of flags: agent sessions receive hidden counts and reasons without hidden package, skill, path, or source identities.

Out of scope

• Changing permission semantics.
• Content hashes, byte drift, or lockfile state.
• Delivery, placement, hook execution, or synchronization state.
• Git source implementation.

Acceptance criteria

Package-level explanations

• Human-readable explanation output identifies why each listed skill is available under the current package-level policy.
• intent list --why --show-hidden identifies why each human-reviewed hidden or excluded candidate is blocked.
• JSON explanation output identifies the package, skill when known, availability result, and stable controlling decision category.
• Output distinguishes explicit package permission, wildcard permission, allow-all mode, absent migration mode, and empty deny-all mode.
• Output distinguishes package exclusion, skill exclusion, package-not-listed, and source-kind-mismatch results.
• Exclusion is reported as the controlling result when it removes a package or skill, including a package that is also not listed.
• Configured packages that were not discovered use "not discovered" language rather than claiming they are not installed.
• Human explanation output includes the effective intent.skills configuration path when available.
• Normal human and JSON output remain compatible when explanation mode is not requested.
• The existing default human notice for unlisted packages remains unchanged.
• --why without --show-hidden does not add hidden package, skill, path, or source identities beyond the existing human notice.
• Agent sessions do not receive hidden package names, skill names, paths, or source identities, even when explanation or hidden-review flags are passed.
• Source-kind-mismatch details are available only in explicit human hidden review.
• The diagnostic does not report content, byte, lockfile, or delivery state.

Per-skill explanations

• After #219 is complete, output distinguishes an explicit per-skill permission from a package-level permission.
• After #219 is complete, configured skills that were not discovered use "not discovered" language.

Dependencies

• #219 for the two per-skill explanation criteria. Package-level explanations can ship independently.

Open decision

Confirm whether intent list --why is the final surface or whether the explanation belongs in another explicit diagnostic mode. The default intent list output must remain concise either way.