GeezerVison

Part of CODAGT-1341.

Adds the database and SDK pieces for editing an organization skill's access control list, with no routes. UpdateOrganizationSkillACLByID in queries/skills.sql writes group_acl, user_acl and updated_at on an org-owned row and returns it; dbauthz loads the row and checks share on its RBACObject(), following the MCP server config ACL pattern. The row lock it pairs with, GetOrganizationSkillByIDForUpdate, comes from the write routes layer. LockOrganizationMembersByUserIDsForShare in queries/organizationmembers.sql locks the listed users' membership rows FOR KEY SHARE, so they can't be removed until the transaction ends; dbauthz checks read on the organization's members. codersdk/skills.go gains OrganizationSkillRole (read, or "" to delete), OrganizationSkillACL, OrganizationSkillUser, OrganizationSkillGroup, UpdateOrganizationSkillACLRequest (sparse user_roles/group_roles), and the experimental client methods OrganizationSkillACL, UpdateOrganizationSkillACL and OrganizationSkillACLAvailable. The next layer adds the routes those methods call.

The second commit generalizes the MCP server config ACL helpers in coderd/mcp_acl.go so the skill routes can reuse them. The changes: type-parameterized principal resolution (resolveACLUsers, resolveACLGroups, aclGroupMemberCounts), one validateOrganizationACLUpdate that runs acl.Validate, the org membership and org match checks, and canonical UUID rekeying with duplicate rejection, plus applyACLReadRoles and writeOrganizationACLAvailable. coderd/rbac/acl gets a named Role constraint that includes the new role type. MCP behavior is unchanged except that its 500 error messages are now generic. The duplicate mcpServerConfigACLReducedUser is gone in favor of the existing reducedUserFromPaginatedOrganizationMember, and the MCP validator type is now unexported.

Testing

• TestMethodTestSuite: new entries UpdateOrganizationSkillACLByID (asserts share) and LockOrganizationMembersByUserIDsForShare (asserts read on organization members).
• The existing MCP ACL tests (TestMCPServerConfigACL, TestMCPServerConfigACLAvailable, TestMCPServerConfigACLWorkspaceSharingModes, TestMCPServerConfigACLConcurrentDelete) pass unchanged against the refactored helpers. So do the chat model ACL tests and ./coderd/rbac/acl/....
• Built and tested at each commit's own tree: go build ./..., the full dbauthz suite, codersdk, golangci-lint on the touched packages, and make gen with no diff.

Review record

• Remote UAT round 6 through Coder Agents: PASS on the final stack tip afdd4a9f954 (chat); its low notes are in docs(docs/ai-coder/agents): document organization skills #30604.

This stack adds organization skills to Coder Agents: admins publish a skill once per organization, share it with groups or members, and chats in that organization load it next to personal and workspace skills.
Stack, bottom to top: #30584, #30585, #30586, #30587, #30588, #30589, #30590, #30591, #30592, #30593, #30594, #30595, #30596, #30597, #30598, #30599, #30600, #30601, #30602, #30603, #30604.

Xum opened this PR on behalf of @ibetitsmike.