Fix workflow skill access denied handling

[louis4li]

Issue

Closes #3600

Scope

• Load scheduled workflow skills with the caller source-readable NyxID bearer used for workflow review/provisioning.
• Convert remote skill source access denial into a typed skill_access_denied failure with actionable remediation text.
• Return HTTP 403 for workflow skill invoke/schedule access denial and log schedule failures under the skill fetch stage.
• Cover service and endpoint behavior for denied remote skill reads.

Verification

• dotnet test test/Aevatar.Capabilities.Tests/Aevatar.Capabilities.Tests.csproj --nologo --filter "FullyQualifiedName~UserSkillRunServiceTests|FullyQualifiedName~WorkflowSkillsEndpointsTests" --no-restore -v quiet passed: 30 tests.
• bash tools/ci/test_stability_guards.sh passed.
• Local Mainnet endpoint/NyxID binding check was attempted but blocked before readiness: Development OAuth client bootstrap requires explicit AEVATAR_NYXID_AUTHORITY and AEVATAR_OAUTH_REDIRECT_BASE_URL.

Notes

• The fix is generic for remote skill access and does not hard-code any X-specific skill or command name.
• Local startup blocker occurred in AevatarOAuthClientBootstrapService.ValidateStartupProvisioningBoundary, before endpoint checks could run.

Generated with Claude Code.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T00:48:33.142753Z	72e1caf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 72e1caf1b3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.44%. Comparing base (e483895) to head (3fe05f3).
⚠️ Report is 1 commits behind head on feature/integrate.

@@                  Coverage Diff                  @@
##           feature/integrate    #3604      +/-   ##
=====================================================
- Coverage              83.44%   83.44%   -0.01%     
=====================================================
  Files                   1709     1709              
  Lines                 197728   197728              
  Branches               23735    23735              
=====================================================
- Hits                  165004   165002       -2     
- Misses                 21683    21685       +2     
  Partials               11041    11041              

Flag	Coverage Δ
ci	83.44% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.