feat(skills): add skills remote commands for the Datadog onboarding API

Adds a `remote` subgroup under `pup skills` that wraps the public
agentic onboarding API, so an AI assistant can discover hosted skills,
fetch their instructions, and record sessions by running `pup` instead
of raw HTTP calls. Distinct from the other `skills` subcommands, which
install the statically bundled skills onto a local assistant.

Commands (all hit /api/v2/onboarding/*):
- `pup skills remote list [--tag …] [--org-id N]`
  GET /api/v2/onboarding/skills. `--tag` filters in memory against each
  skill's frontmatter tags (repeatable; AND semantics).
- `pup skills remote get <skill_id> [--intent …] [--session-id …] [--org-id N]`
  GET /api/v2/onboarding/skills/{id}?format=md, printed as raw markdown.
  `--session-id` maps to the API's `onboarding_run_id` query param.
- `pup skills remote sessions create --session-id … --skill-id … --summary …
  --status … [--org-id N]` → POST /api/v2/onboarding/sessions (JSON:API).

Details:
- Auth is opportunistic: routes are OpenAuth, so credentials are attached
  when present but never required.
- skill_id is percent-encoded before path interpolation.
- Terminal session statuses (completed/failed/abandoned) require at least
  one --skill-id; in_progress may be empty, mirroring the backend.
- Read-only guard: `skills` stays exempt for local installs, but
  `skills remote` is not, so `pup --read-only skills remote sessions create`
  is correctly blocked (via a new is_read_only_exempt helper).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: tedkahwaji

src/commands/mod.rs

@@ -76,6 +76,8 @@ pub mod security;
 pub mod service_catalog;
 #[cfg(not(target_arch = "wasm32"))]
 pub mod skills;
+#[cfg(not(target_arch = "wasm32"))]
+pub mod skills_remote;
 pub mod slos;
 pub mod software_catalog;
 pub mod static_analysis;