Support SEP-2640 Skills Extension (skills over MCP) as host

What problem would this solve? MCP has no standard way to ship workflow instructions alongside the tools they describe. Server instructions are size-bounded, so complex workflows do not fit. Today a server and the skill that teaches how to use it are versioned, discovered and installed separately, and each server invents its own ad-hoc skill URI convention.

SEP-2640 (io.modelcontextprotocol/skills, modelcontextprotocol/modelcontextprotocol#2640, merged) fixes this by serving Agent Skills over MCP Resources: skill:// URIs plus skills/list, skills/get, and optional resources/directory/read. Goose can read generic resources today but cannot enumerate or verify remote skills.

What would a good outcome look like? Goose as host supports the Skills Extension:

• detects io.modelcontextprotocol/skills on initialize
• skills/list merged into existing discovery alongside local ~/.agents/skills, project skills and plugin skills
• skills/get plus resources/read through the existing load_skill path with digest verification and progressive disclosure (SKILL.md first, lazy references and scripts)
• nested-skill fresh consent and allowed-tools gate in the existing permission flow
• connecting a server auto-surfaces its companion skill, versioned with the server

Possible approaches

• Baseline already works: skill:// files exposed as plain resources are readable via McpClientTrait::read_resource and list_resources. No change needed.
• Phase 1: custom skills/list and skills/get via send_request_with_context, new SourceType::RemoteMcpSkill merged into discover_skills_with_config and SourceEntry, extend load_skill to accept skill:// URIs.
• Phase 2: optional resources/directory/read gated by directoryRead, content-binding plus re-approval on digest change per SEP Security Implications.
• Reuse crates/goose/src/skills/client.rs (SkillsClient) and supporting_files.rs. No new skill format, format stays delegated to agentskills.io.

Additional context

• Spec: modelcontextprotocol/modelcontextprotocol#2640, seps/2640-skills-extension.md, extension id io.modelcontextprotocol/skills.

• This stacks with #11043 (Agent Plugins), it does not compete: Plugins is on-disk distribution (plugin.json plus skills plus mcp.json), SEP-2640 is wire transport (zero-install skills that travel with the server). Both speak the same inner SKILL.md format and can land in the same load_skill. A plugin mcp.json pointing at a skills-capable server gets offline snapshot plus live version.

• I would like to implement this if maintainers agree on scope. Happy to start with Phase 1 host support and conformance against the SEP reference servers.

• I have verified this does not duplicate an existing feature request

Do not begin implementation until the issue reaches Ready on the Goose Issues board.