Disclaimer

This is only here for iteration purpose! Do not make any code rely on this

Why

Skills still live behind codex-core discovery and injection paths, but the extension system needs an authority-aware home before that logic can move. This adds that boundary without changing current skills behavior, and keeps host, executor, and remote skills distinct so future list/read/search flows do not collapse back to ambient local paths.

What changed

• Add the codex-skills-extension workspace/Bazel crate under ext/skills.
• Define the initial catalog, authority, provider, and turn-state types for authority-bound skill packages and resources.
• Register placeholder thread/config/prompt/turn lifecycle contributors plus host, executor, and remote provider aggregation points.
• Capture the remaining extraction work as TODOs, including the missing extension API hooks needed for per-turn catalog construction and typed skill injection.
• Keep plugins outside the runtime skills model: plugin-installed skills are treated as materialized host-owned skill sources once available.

Verification

• Not run locally.