feat: skill trust levels and quarantine system (M25)

[bug-ops]

Summary

• 4-tier skill trust model: Trusted > Verified > Quarantined > Blocked
• TrustGateExecutor enforces per-turn restrictions based on minimum trust level across active skills
• AnomalyDetector with sliding-window threshold counters for quarantined skill monitoring
• blake3 content hashing for integrity verification on load and hot-reload
• Quarantine prompt wrapping for structural isolation of untrusted skill bodies
• Self-learning disabled for skills with trust < Verified
• SQLite migration 009 with trust CRUD operations
• CLI commands: /skill trust, /skill block, /skill unblock
• [skills.trust] config section

Crates modified

Crate	Changes
zeph-skills	TrustLevel, SkillSource, blake3 hashing, quarantine prompt wrapping
zeph-tools	TrustGateExecutor, AnomalyDetector
zeph-memory	skill_trust table migration + CRUD
zeph-core	TrustConfig, agent loop integration, self-learning gate, CLI commands

Security

Addresses threat model from security analysis:

• AV-1 (prompt injection): quarantine wrapping with restriction warnings
• AV-2 (privilege escalation): TrustGateExecutor blocks denied tools
• AV-3 (self-learning abuse): trust gate in learning.rs
• AV-4 (hot-reload tampering): hash verification on reload

Test plan

• 1381 tests pass (35 new tests for trust system)
• Clippy clean, fmt clean
• Security audit: 3 critical/high findings fixed, verified by reviewer
• Performance: no measurable overhead (all checks O(1) on hot path)

Closes #418, closes #419, closes #420, closes #421, closes #422