chore(skills): docs + ruff format for skill-management-console

Documents Skill Management in CLOUD_DEPLOYMENT.md (cloud-skill store,
per-host entitlement, incremental sync, local authoring/override,
inventory report, skills:admin scope) and applies ruff check/format to
all touched modules. All tasks complete; full non-integration suite
green (593 passed) and openspec validate --strict passes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/CLOUD_DEPLOYMENT.md

@@ -478,6 +478,29 @@ legacy Provider environment configuration, while a rollback to `direct`
 transport requires valid provider credentials on that Host; preserve usage and
 policy rows rather than deleting accounting history.
 
+## Skill Management
+
+Cloud-origin Skills are administrator-managed through the Cloud Console's
+**Skills** view (requires the `skills:admin` scope, which administrators
+hold via the `*` scope). Create/edit/delete skills (knowledge or flow-template
+kinds), and grant or revoke per-host entitlement — an agent only ever sees the
+cloud skills entitled to its own host.
+
+Agents pull their entitled cloud skills incrementally from the Cloud API
+(`GET /internal/v1/hosts/{host_id}/skills/sync`) on a configurable cadence
+(`HOST_AGENT_SKILL_SYNC_INTERVAL_SECONDS`, default 300s) and cache them in a
+local SQLite file (`tasks/skills.sqlite3`). Agents may also author their own
+**local skills** (persisted in a separate `tasks/local_skills.sqlite3`) and
+**override** a cloud skill locally via the MCP authoring tools; an override
+shadows the cloud skill until removed, and forks into a standalone local skill
+if the cloud entitlement is revoked. Agents report a best-effort read-only
+inventory of their local skills to the Cloud so the Console can display them
+per host.
+
+The cloud skill store, entitlement mapping, per-host sync versioning, and
+inventory readback live in the Cloud platform database (migration
+`0010_skill_management`).
+
 ## Operational Limitations
 
 Run exactly one scheduler-enabled Cloud API process. SQLite supports only the