Remove Agent Skills from backend: API, SDKs, CLI, drop tables (skills purge, stage 3)

[mgoldsborough]

Stage 3 of 4: bundle-only backend

The largest stage of the mpak refocus. Removes Agent Skills from the registry API, both SDKs, the CLI, and the database. mpak's backend now does one thing: serve security-scanned MCPB bundles.

Builds on #124 (positioning) and #125 (web + docs).

⚠️ BREAKING CHANGE. Per the "hard removal" decision: the /v1/skills API, mpak skill commands, skill SDK methods, and the skills/skill_versions tables are deleted. Published skills, skill installs, and skill badge embeds are no longer served. Skill packaging/distribution moves to the skills.sh / npx skills ecosystem.

Registry (apps/registry)

• Delete routes/v1/skills.ts, SkillRepository, utils/skill-content.ts; unregister /v1/skills, drop the skills swagger tag and the Discord skill branch
• Remove skills from the Prisma repositories decoration
• Prisma: drop Skill/SkillVersion models + a migration that DROPs the tables (canonical Prisma-generated SQL)
• Rewrite seed.ts to seed example bundles (Package → Version → Artifact → completed SecurityScan with trust levels), replacing the old skill seed
• Delete skill tests; prune skill mocks from shared test helpers

Packages

• schemas: delete the skill schema + skill validators
• sdk-typescript: remove searchSkills/getSkill/getSkillDownload/getSkillVersionDownload/downloadSkillBundle + skill types
• sdk-python: remove generated skill types (it's OpenAPI-generated — the long-term fix is regenerating from the updated registry spec; clean hand-removal for now)
• cli: delete src/commands/skills/, the mpak skill namespace, and skill completions; unified mpak search is now bundle-only (kept bundle search --type, which is the unrelated server-type filter)

Verification (all green)

Migration + seed validated against a throwaway Postgres:

• prisma migrate deploy applies the drop cleanly · migrate status reports no drift · skill tables confirmed gone
• seed runs and is idempotent (identical counts on re-run; trust levels render)

Static suite:

• pnpm typecheck 7/7 · pnpm build 6/6 · pnpm test (registry 125 + all packages) · biome ci (209 files) · ruff (python SDK) ✓

Net

+479 / −6,285 across 60 files.

Merge ordering

Independent of #125 at the code level (the web app has its own HTTP client, not the SDK), but for the cleanest deploy, land #125 (web/docs) before or with this PR so the UI isn't briefly calling removed /v1/skills endpoints. CHANGELOG history is preserved; the breaking change is recorded under [Unreleased].