feat(skills): a skill that must be read cannot be left to be noticed

The `index` arm hands an agent a list of uris and trusts it to fetch what
applies. Measured on the first A/B pair, that is mostly what happens — each
agent fetched the skill bound to its own role and no other, which is the result
that made Trigger observable at all.

`workspace-repo-commit-protocol` is the case it fails on. It scored Trigger=FAIL
beside a PASSING boundary check: the rule was live and unread. A procedure that
applies to everyone who writes reads as nobody's in particular, so no agent
recognises it as theirs and no agent fetches it.

Upstream ZeroClaw arrived at the same place from the other direction and gave
its compact injection mode an `always: true` frontmatter escape hatch (#9520).
This is that hatch as a column: `skills.always_inject`, default FALSE, so
nothing changes for an existing skill and the inline arm is untouched either
way.

Two halves, because delivering it and scoring it are different mistakes:

- Delivery: under `Index`, an `always_inject` skill renders its BODY.
- Scoring: the arm belongs to the PROMPT and `always_inject` belongs to the
  SKILL, so the scorer now asks per skill which one it got. A skill whose body
  is in the prompt was handed over, and a Trigger miss cannot be charged against
  an agent that was never asked to fetch anything.

`skill_was_indexed` reads that off the rendered prompt via `READ_IT`, a
constant now shared with `index_entry` — two spellings of one marker is how a
detector quietly stops detecting.

Suite: 108 binaries, 840 tests, green.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz

crates/cm-api/src/topology_exec.rs

@@ -399,8 +399,17 @@ impl ZeroClawDriveExecutor {
         let mut out = String::new();
         let mut n = 0usize;
         for b in bindings.iter().filter(|b| b.pin_in_context) {
+            // `always_inject` overrides the arm. Progressive disclosure asks
+            // the agent to recognise that a procedure applies before fetching
+            // it, and a CROSS-CUTTING procedure is the case that breaks: the
+            // first A/B pair had `workspace-repo-commit-protocol` scored
+            // Trigger=FAIL beside a passing boundary check, because a rule that
+            // applies to everyone who writes reads as nobody's in particular.
             let text = match mode {
                 crate::skill_delivery::Mode::Inline => b.skill.body.clone(),
+                crate::skill_delivery::Mode::Index if b.skill.always_inject => {
+                    b.skill.body.clone()
+                }
                 // An entry is a few hundred bytes whatever the body weighs, so
                 // the index arm cannot hit the cap that follows. That is the
                 // point of it, and the reason the cap is checked against the