feat: add SkillPolicy to skill metadata and support allow_implicit_invocation (#11244)

Tested by setting the policy in agents/openai.yaml to true, false, and
leaving it unset (default).
```
policy:
  allow_implicit_invocation: false
```
<img width="847" height="289" alt="Screenshot 2026-02-09 at 3 42 41 PM"
src="https://github.com/user-attachments/assets/d3476264-3355-47cf-894a-4ffba53e3481"
/>

codex-rs/tui/src/chatwidget/skills.rs

@@ -189,6 +189,7 @@ fn protocol_skill_to_core(skill: &ProtocolSkillMetadata) -> SkillMetadata {
                     })
                     .collect(),
             }),
+        policy: None,
         path: skill.path.clone(),
         scope: skill.scope,
     }