fix(adapter): isolate nested OpenClaw skills

[limaronaldo]

Summary

• detect direct .agents/skills/<skill>/SKILL.md layouts in addition to a root SKILL.md
• emit one ScanTarget per skill root instead of merging unrelated skills
• keep root and nested skills isolated when both layouts exist
• reuse the shared parse/analyze/merge pipeline
• sort skill roots deterministically and reject deeper undocumented nesting

Why

The initial local implementation combined every discovered skill into one target. That could let cross-file analysis and detector attribution cross skill boundaries. This change preserves the conservative attribution contract by treating each skill directory as an independent extension.

Compatibility

Existing root-level SKILL.md projects still produce one OpenClaw target. No public Rust API, output schema, detector, policy, fingerprint, or dependency changes.

Review

Diff-scoped code review found and resolved three issues before publication: cross-skill attribution, overly broad nested discovery, and duplicated pipeline logic. No unresolved findings remain.

Validation

• cargo fmt --all --check
• cargo check --workspace --all-targets --locked
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo test --workspace --all-targets --locked — 422 passed
• cargo test --no-default-features --locked — 388 passed
• supported python, typescript, runtime, and runtime-guard feature checks
• git diff --check

[limaronaldo]

Code review verdict: PASS — no unresolved findings.

Checklist:

• existing root SKILL.md behavior remains one target
• direct .agents/skills/<skill>/SKILL.md roots are deterministic
• each skill has an independent target, source set, and analysis pipeline
• root and nested layouts do not merge execution surfaces
• deeper undocumented nesting is rejected
• directory symlinks are not followed as skill roots
• scan include/exclude filtering remains anchored to the requested scan root
• shared pipeline replaces duplicated parse/analyze/merge logic
• no public API, output, policy, detector, fingerprint, or dependency change
• default/no-default and supported feature configurations pass