fix(skills): refuse a partial skill body on dashboard read

[cursor]

Dashboard skill edit could save a prefix and delete the rest of the file.

Bug and impact

GET /api/skills/:name loaded the skill through skill_get_content into a 32768-byte buffer. The read stopped when the buffer filled and still returned success. The dashboard copies that body into the editor and PUTs it back on Save, so a skill longer than the buffer lost its tail. A response that did not fit the 64 KiB HTTP buffer was also returned as HTTP 200 with a cut-off JSON body. fetch().json() then failed and the editor treated the content as empty, so Save wiped the file.

Root cause

skill_get_content copied until out_size and returned 0 without checking that the file was fully read. handle_skill_get then printed that prefix, and json_response clamped any oversized JSON to the response buffer while leaving status 200.

Fix

skill_get_content returns -2 when the file does not fit, including a short read. GET /api/skills/:name returns 413 with the skill name and the limit instead of a truncated 200. A skill that fits is unchanged.

Validation

make test_skill and ./build/test_skill pass, including a new case that a short buffer returns -2 and an exact-fit buffer returns the full body.

make GATEWAY=1 test_gateway_http and ./build/test_gateway_http pass. A 40000-byte skill returns HTTP 413 and the on-disk tail is still present. A small skill still returns HTTP 200 with its full text.