Harden the seams a project sweep surfaced

A systematic review of the whole codebase (main process, renderer,
IPC/migration/packaging seams) surfaced four real defects; each is
fixed at its root:

- Legacy catalogue drift: the operator's profile still carried 89
  active skills from the removed ~/.agents import era next to the 228
  built-ins. Catalogue sync now mirrors the bundle - actives whose slug
  the bundle does not ship retire (bindings keep resolving via their
  pinned revisions; retired skills leave list_skills and cannot be
  granted anew)
- Broken-bundle guard: staging now refuses a bundle without the
  humanizer skill, so an empty or quarantined resources folder can
  never trigger the mirror pass into retiring a healthy catalogue
- Duplicate agent names: @mentions, DM routing, and task assignment all
  resolve by name, so createAgent and updateAgent renames now reject a
  name already held by an active agent (case-insensitive); the mention
  resolver still refuses to guess between legacy duplicates
- Stale DM titles: agent-to-agent conversation rows titled themselves
  from the frozen creation-time space name, so renames never reached
  the sidebar; direct titles now derive from members' current names

Verified clean in the same sweep: IPC surface (82 channels, handler +
preload + api aligned), per-migration transactions with rollback,
quota-parking month rollover, retry-budget counting, meeting spot
reuse across floor-plan rebuilds.

src/main/services/skill-service.ts

@@ -48,6 +48,34 @@ export class SkillService {
     return Boolean(this.db.prepare("select id from skill_definitions where org_id = ? and slug = ?").get(orgId, slug));
   }
 
+  /**
+   * Retires every active skill whose slug is not in `keepSlugs`, so the org
+   * catalogue mirrors the shipped bundle. Bindings pin revisions directly
+   * and keep resolving; retired skills leave list_skills and cannot be
+   * granted anew. Returns the retired slugs.
+   */
+  retireSkillsNotIn(orgId: string, keepSlugs: string[]): string[] {
+    const keep = new Set(keepSlugs);
+    const active = this.db.prepare("select id, slug from skill_definitions where org_id = ? and status = 'active'")
+      .all(orgId) as Array<{ id: string; slug: string }>;
+    const retired: string[] = [];
+    for (const skill of active) {
+      if (keep.has(skill.slug)) continue;
+      this.db.prepare("update skill_definitions set status = 'retired' where id = ?").run(skill.id);
+      this.audit.record({
+        orgId,
+        entityType: "skill_definition",
+        entityId: skill.id,
+        actorType: "system",
+        actorId: null,
+        action: "retired",
+        payload: { slug: skill.slug, reason: "not_in_builtin_bundle" },
+      });
+      retired.push(skill.slug);
+    }
+    return retired;
+  }
+
   importManifest(orgId: string, directoryPath: string, manifest: SkillManifest, explicitSlug?: string): string {
     const slug = explicitSlug ?? slugify(manifest.name);
     if (!slug) throw new Error("Skill name could not be derived.");