Align Files and Skill resource semantics

[SaladDay]

Files and Skills differed from the pinned official resource behavior: direct user_data downloads succeeded, unknown purpose filters silently returned an empty page, and changing a Skill default left its top-level name and description stale. Align these operations and the default-version deletion error, while retaining authorized internal file copies and immutable frozen Session inputs.

Correct existing Skill metadata with a data-only migration. Remove the unavailable Core Web source download action; keep the SDK operation and its error behavior. No harness, Runtime, provider, model loop or source-upload purpose expansion. A reproduced browser-test focus race uses the neighboring test's existing focus wait; credential behavior and assertions are unchanged.

Validation:

• Fixed SDK 3.13.0 and raw official API: 56 requests, three owned Files and two Skills; all public deletions acknowledged.
• Actual Core HTTP/PostgreSQL acceptance: resource behavior, tenant isolation, atomic rejection and immutable versions; migration and frozen-input regressions.
• All required make check targets passed: server gate plus fresh local Web gate (287 client, 583 Web unit, 63 doctor, 76 browser checks); sqlc/OpenAPI generated. Fresh independent Astra high review found no material issues and separately passed the relevant API/PostgreSQL/SDK regressions.

Known limits: no new native/model profile qualification, successful official purpose filtering and empty-purpose semantics unverified, sole-version deletion and observed delayed version visibility remain queued. Source expiration and resumable Uploads are separate work. See contracts/agents-api/file-resource-semantics.md for evidence boundaries.