feat(skills): add read-only Agent Guild trust check

[AgentTanuki]

• A human has tested these changes.

---

Why

OpenHands agents evaluating an unfamiliar autonomous-agent counterparty need a bounded way to inspect trust evidence. This adds an opt-in skill for checking Agent Guild evidence and verifying a public passport, without granting delegation or payment authority.

Summary

• Add the agent-guild-trust skill, marketplace entry, vendor manifests, README, and generated catalog entry. The skill remains off by default.
• Treat remote content as untrusted data; forbid automatic delegation, payment, registration, installation, and other side effects. State that /check is paid and stop at HTTP 402 or a credit requirement without following payment instructions.
• Resolve the README catalog conflict against current upstream and regenerate the skill catalog, preserving all upstream marketplace entries and the manually maintained README sections.

Issue Number

Closes #543.

Issue #543 currently has no labels. Its enhancement-readiness content passes a local check when evaluated as an enhancement; this is not a readiness designation. Maintainer triage and the required ready-for-dev label remain pending.

How to Test

uv sync --group test
uv run python scripts/sync_extensions.py --check
npm run build:skills
uv run --group test pytest tests/ -q
git diff --check

Locally validated against upstream 6242eacba016bf85009d8e3f5b8aa131295e278c (extensions version 0.21.0) on macOS with Python 3.12, Node 22.23.2, and an isolated Python environment: 905 passed, 24 skipped. The sync check passes with the existing non-blocking issue-duplicate-checker coverage warning. Native catalog generation produces 64 skills with 11 default-enabled; Agent Guild is not among those defaults. Whitespace checks pass.

The local run used an isolated environment with existing test dependencies and installed this checkout's 0.21.0 wheel. It was not a clean Linux CI run. No live Agent Guild request, model invocation, payment, or human test was performed. Remote SDK synchronization and Claude Code CLI validation were not run; fork workflow approval and required review readiness are not established.

Video/Screenshots

Not applicable; this is a Markdown skill and generated catalog update.

Notes

The skill uses the host's existing HTTP or MCP client. A trust verdict is evidence, never authority. The conflict repair retains the original plugin manifests and vendor links; only the skill's paid-ranking clarification and its README explanation change the prior skill text.

[all-hands-bot]

👋 This PR needs a couple of things fixed before OpenHands can review it:

• the PR description's HUMAN: section needs at least 20 characters describing what you tested, not just the template placeholder

Push an update once this is addressed and this check re-runs automatically.

This is an automated check - no AI was used to generate this comment.