Bundle building-bb-apps as a built-in injected skill

[SawyerHood]

Summary

bb had no repo-shipped skills — building-bb-apps existed only as a hand-authored file in one machine's ~/.bb/skills/. This PR creates the built-in skill concept and ships the app-builder skill with every install.

Mechanism

• Contract: new builtin variant on hostDaemonInjectedSkillSourceSchema (applicationId: null); HOST_DAEMON_PROTOCOL_VERSION 31 → 32 (follows the precedent of the original skills-injection bump); dedicated union test pinning all three variants and applicationId rules.
• Content: apps/server/src/services/skills/builtin-skills/building-bb-apps/SKILL.md, copied to dist/builtin-skills/ by a new build step (copy-builtin-skills.ts, mirroring the app-scaffold-template copy). The dependency-free builtin-skills-copy.ts resolves the root beside the module in both src (dev/tsx) and dist (bundled) layouts, sentinel-checked.
• Discovery: the server scans the builtin root alongside the existing data-dir and global-app roots. Override precedence: a user data-dir/app skill with the same name silences the builtin (info log) — the customization escape hatch, and what keeps existing local copies working. Collisions among user sources keep the existing drop-all rule.
• Wiring: builtinSkillsRootPath resolved once at server boot into ServerRuntimeConfig, passed explicitly; test harnesses point it at hermetic temp roots.
• Daemon: staging is sourceType-agnostic — no behavior change; the new variant flows through hashing and catalog.json. Agents still see the skill as bb-global-skills:building-bb-apps.

Drive-bys

• Regenerated the SDK app-runtime browser bundle (it embeds the contract schema; staleness check would fail CI otherwise).
• TemplateKind: removed unused skill_seed, added the actually-generated system-message, replaced the unchecked kind cast with validation at decode.

Known limitation (documented in resolveInjectedSkillSources)

Skill source paths are server-machine paths read by the daemon's local fs; daemons on additional hosts skip them with a staging warning — exact parity with data-dir/app skills today.

Test plan

• New coverage: builtin discovery, data-dir/app override of builtins, builtin silenced under user-user collision, bundled-root validity of the real SKILL.md, dist copy/resolution roundtrip, daemon staging of a builtin source, contract union variants.
• Suites green: server 950, host-daemon 386, contract 36, templates 13, sdk 87, integration 51; build/typecheck/lint clean across touched packages.
• Verified dist/builtin-skills/building-bb-apps/SKILL.md ships via the server build.

🤖 Generated with Claude Code