feat(skills): add read-only Agent Guild trust check

[AgentTanuki]

• A human has tested these changes.

---

Why

OpenHands agents increasingly delegate to other autonomous agents and external services. This adds a narrow, evidence-backed pre-delegation check without granting payment or mutation authority.

Summary

• Add a progressive-disclosure agent-guild-trust skill for autonomous-agent vetting and passport verification.
• Treat all remote response fields as untrusted data and forbid automatic delegation, payment, registration, dependency installation, and other side effects.
• Add the marketplace entry, generated catalog artifact, vendor manifests, and human-facing README.

Issue Number

Closes #543.

The issue content passes the repository enhancement-readiness checker locally. The enhancement label was requested at creation but was not applied; maintainer triage and the workflow-managed ready-for-dev label remain pending.

How to Test

Run:

uv sync --group test
uv run python scripts/sync_extensions.py --check
npm run build:skills
uv run --group test pytest tests/ -q
git diff --check

Validated the merged current upstream (39fc25a91749fe248db391315c2c4eb2c74655a6) at head d374634f11348e48584dabe930106ed1d2bc7992 with Python 3.12 and the repository's declared test dependencies: 801 passed, 24 skipped. Catalogue generation is synchronized and the sync check reports only the existing non-blocking issue-duplicate-checker coverage warning. Every upstream marketplace entry is preserved; the Agent Guild skill files are byte-identical to the original PR head and the skill remains off by default. No model request or payment was made.

This automated validation does not claim human testing. Maintainer approval is still required for fork workflows.

Video/Screenshots

Not applicable; this is a Markdown skill and generated catalog update.

Notes

The skill uses the host's existing HTTP or MCP client. It does not install or execute remote code, and a trust verdict is explicitly evidence rather than authority.

[all-hands-bot]

👋 This PR needs a couple of things fixed before OpenHands can review it:

• the PR description's HUMAN: section needs at least 20 characters describing what you tested, not just the template placeholder

Push an update once this is addressed and this check re-runs automatically.

This is an automated check - no AI was used to generate this comment.