Catalogue capabilities and remove duplicate skills

[fredporter]

Outcome

• adds an exhaustive fail-closed internal capability catalogue
• records owner, lifecycle, risk, lane, and allowed roots for every remaining builtin module
• removes nine unowned or duplicated skill modules
• removes the obsolete code-analysis skill specification
• removes the stale MCP surface-registry tool and outdated skill-count claims

Reduction

• 4,293 obsolete lines removed

Verification

• backend: 502 passed, 6 existing aiohttp warnings
• focused skills: 11 passed
• MCP bridge TypeScript build: passed
• Ruff: passed
• docs non-regression: passed