Avoid parsing skill metadata rejected by effective policy

从 packages/intent/src/core/source-policy.ts 中的 scanForPolicedIntents 以及 packages/intent/src/discovery/register.ts 的注册相关部分开始。复现 synthetic fixture 对 package 读取、skill 文件读取、输出和耗时的测量，然后跟踪 policy 解析和传递遍历。完成的标准是：被拒绝的 skill 文件不会被解析，允许的结果和 diagnostics 保持不变，并且通过 tests 或 fixtures 记录测得的减少量。

Problem

Policy-controlled discovery scans skill metadata before applying permission and exclusion rules, doing work for content that will never be exposed.

Evidence

With intent.skills: [] and 100 installed skill packages, listIntentSkills returned zero skills but reported 101 package manifest reads. scanForPolicedIntents calls the raw scanner before policy resolution, and registration discovers skills before filtering.

Sources: scan ordering, registration.

Verified against main at 206e987 (@tanstack/intent 0.3.8), Node v24.12.0 on macOS arm64. Tests used installed dependencies and synthetic local fixtures.

Acceptance criteria

• Measure package reads, skill-file reads, output, and elapsed time before and after on the same fixtures.
• Resolve and validate policy before policy-controlled metadata parsing.
• Agent-visible discovery does not parse denied skill files.
• Preserve traversal needed to locate permitted transitive packages through unlisted parents.
• Preserve human review of hidden candidates and current policy diagnostics through an explicit appropriate discovery path.
• Show identical permitted results and a measured reduction in denied-content work, with no weakening of path or policy checks.

Scope and priority

Priority: Medium. Type: performance.

Follow-up optimization after policy correctness fixes. No persistent cache, broad scanner rewrite, or new dependency solely to optimize this path.