GeezerVison

Part of CODAGT-1341.

Adds authorization and queries for organization skills, with no routes yet.

• RBAC resource organization_skill with create, read, update, delete and share. Owner and org admin get it automatically; site and org auditors get read. Members get no role grant and can read a skill only through its ACL, which the policy applies only to members of the skill's organization. API keys can request organization_skill:{read,create,update,delete,share,*}.
• Migration 000617_organization_skill_resource adds the resource_type and api_key_scope enum values; its down is a no-op because enum values cannot be dropped. codersdk.ResourceTypeOrganizationSkill is added; the audit mapping comes in a later layer.
• Skill.RBACObject() returns ResourceOrganizationSkill.WithID(id).InOrg(org) with both ACLs for organization rows; project rows stay denied to everyone.
• Queries in queries/skills.sql: insert, get by organization and name, ListOrganizationSkillMetadataByOrganizationID (no content; -- @authorize_filter), update with optional sqlc.narg description, content and enabled (so toggling enabled is one statement), and delete. The list goes through the handwritten GetAuthorizedOrganizationSkillMetadata and regosql.OrganizationSkillConverter() (organization ID, both ACL columns, owner always false).
• dbauthz: insert checks create on InOrg(org); get, update and delete fetch the row and check its object, so ACLs apply. dbgen.OrganizationSkill adds test rows. ACL write queries come later.

Testing

• coderd/rbac/roles_test.go role matrix (a user ACL grant lets an org member read but not write or share, and does nothing for a non-member), TestOrganizationSkillReadScope (a read key can't write or share), TestSkillRBACObjectOrganizationACL (a grant allows read, not update).
• TestOrganizationSkillAuthorization (real Postgres, strict authorizer): the site owner, org admin and org auditor list every skill; members see only skills shared through Everyone, their group or a user grant; granted non-members and other orgs' members see nothing; a read grant cannot write. TestMethodTestSuite/TestOrganizationSkills covers every new dbauthz method.
• Red-green: dropping the auditor grants, the scope entry, the object's ACLs, the converter's ACL matchers, or the list's SQL filter each failed the matching test.
• Ran make pre-commit, make lint/check-scopes, golangci-lint and package tests at each commit.

Review record

• Remote UAT round 6 through Coder Agents: PASS on the final stack tip afdd4a9f954 (chat); its low notes are in docs(docs/ai-coder/agents): document organization skills #30604.

This stack adds organization skills to Coder Agents: admins publish a skill once per organization, share it with groups or members, and chats in that organization load it next to personal and workspace skills.
Stack, bottom to top: #30584, #30585, #30586, #30587, #30588, #30589, #30590, #30591, #30592, #30593, #30594, #30595, #30596, #30597, #30598, #30599, #30600, #30601, #30602, #30603, #30604.

Xum opened this PR on behalf of @ibetitsmike.