Explain why each skill is available or blocked

首先跟踪现有的 intent list 命令及其面向人类和 JSON 的输出路径，然后查看 dependency #219 以了解按 skill 划分的 policy 表单。在实现之前定义最终的显式诊断面，同时保持正常输出不变并保留 agent 脱敏。完成的标准是验收标准能够区分每个列出的 policy 结果、排除项、未发现的条目以及隐藏审查行为。

Problem

intent list shows available skills and can show hidden source summaries, but it does not identify the exact policy decision that made a package or skill available or blocked. Consumers must reconstruct the result from inherited intent.skills, wildcard matching, source kind, and intent.exclude rules.

User outcome

A human can inspect a skill-level diagnostic in human-readable or JSON form and understand why each relevant skill is available, blocked, or not discovered.

In scope

• Add an opt-in human-readable explanation mode for intent list, proposed as intent list --why.
• Add corresponding structured JSON fields with stable decision categories.
• Identify the controlling policy result for explicit package permission, wildcard permission, allow-all mode, absent migration mode, empty deny-all mode, package exclusion, skill exclusion, package not listed, source-kind mismatch, and configured-but-not-discovered entries.
• Add per-skill permission explanations after #219 defines that policy form.
• Report exclusion as the controlling result when a discovered package is both excluded and not listed; preserve the current suppression of the unlisted-source notice for explicitly excluded packages.
• Include the configuration file that owns the effective inherited intent.skills declaration in human explanation output when available.
• Preserve normal intent list output when explanation mode is not requested, including the existing human notice that names unlisted packages.
• Use intent list --why --show-hidden for detailed human review of hidden package and skill identities; --why without --show-hidden does not add hidden identities beyond the existing notice.
• Preserve agent redaction regardless of flags: agent sessions receive hidden counts and reasons without hidden package, skill, path, or source identities.

Out of scope

• Changing permission semantics.
• Content hashes, byte drift, or lockfile state.
• Delivery, placement, hook execution, or synchronization state.
• Git source implementation.

Acceptance criteria

Package-level explanations

• Human-readable explanation output identifies why each listed skill is available under the current package-level policy.
• intent list --why --show-hidden identifies why each human-reviewed hidden or excluded candidate is blocked.
• JSON explanation output identifies the package, skill when known, availability result, and stable controlling decision category.
• Output distinguishes explicit package permission, wildcard permission, allow-all mode, absent migration mode, and empty deny-all mode.
• Output distinguishes package exclusion, skill exclusion, package-not-listed, and source-kind-mismatch results.
• Exclusion is reported as the controlling result when it removes a package or skill, including a package that is also not listed.
• Configured packages that were not discovered use "not discovered" language rather than claiming they are not installed.
• Human explanation output includes the effective intent.skills configuration path when available.
• Normal human and JSON output remain compatible when explanation mode is not requested.
• The existing default human notice for unlisted packages remains unchanged.
• --why without --show-hidden does not add hidden package, skill, path, or source identities beyond the existing human notice.
• Agent sessions do not receive hidden package names, skill names, paths, or source identities, even when explanation or hidden-review flags are passed.
• Source-kind-mismatch details are available only in explicit human hidden review.
• The diagnostic does not report content, byte, lockfile, or delivery state.

Per-skill explanations

• After #219 is complete, output distinguishes an explicit per-skill permission from a package-level permission.
• After #219 is complete, configured skills that were not discovered use "not discovered" language.

Dependencies

• #219 for the two per-skill explanation criteria. Package-level explanations can ship independently.

Open decision

Confirm whether intent list --why is the final surface or whether the explanation belongs in another explicit diagnostic mode. The default intent list output must remain concise either way.