GeezerVison

Part of CODAGT-1341.

Adds the organization skills admin page at /ai/settings/skills?org=<name>, modeled on the MCP servers page. It mounts the shared SkillsTable with an organization picker in a new toolbar slot.

• Access: a new site check viewAnyOrganizationSkills (organization_skill, any_org, read) gates the route, the Skills sidebar item (deployment admin group and the organization-admin-only case), and the AI settings navbar link. AISettingsIndexRedirect sends such a user here when no earlier AI settings page applies.
• A per-organization view check picks the organizations the picker lists. SkillsTable takes a SkillAccess object (fullSkillAccess, readOnlySkillAccess) instead of canEdit, and each permission gates its own controls: create gates Add skill, the empty-state add action and the limit notice; update gates the Enabled switch and Edit (View otherwise); delete gates Delete. An org auditor gets a read-only table.
• With no ?org=, the page picks a readable default. A requested organization the user cannot read shows the permission-denied page instead of falling back, so a skill is never added to an organization the URL did not name.

Members with only ACL access have no role-based read and do not get this page; later layers add their view and Manage permissions.

Testing

• AISettingsIndexRedirect.test.tsx: an organization skills reader is redirected to Skills (fails without the redirect). New SkillsPage.test.tsx: picking another organization sets ?org and sends the next skills request to it (fails when the picker stops setting org); a read and update only role can toggle and open Edit (fails without the fix).
• New stories: six SkillsPage states (admin, auditor, empty, several organizations, denied organization, permissions load error), two sidebar stories, and SkillsTableView UpdateOnlyRowMenu.
• tsc, biome, knip, Vitest and the touched stories pass.

Review record

• frontend-review passed; coder-frontend-review (eight roles, three rounds) fixed SD3, SD1, TS6, DF1 and TS7 (the permissions load error story).
• Declined: RO2 (about 30 repeated lines of the MCPServersPage shell, left as is), RO4 (importing the picker from MCPServersPage matches other AI settings code), and TS6 for organizationsPermissions(...).queryKey (that module keeps its key private).
• Remote UAT round 6 through Coder Agents: PASS on the final stack tip afdd4a9f954 (chat); its low notes are in docs(docs/ai-coder/agents): document organization skills #30604.
• UAT round 4: an unknown or unreadable ?org shows the permission-denied page without the picker, while MCP servers and Models fall back to the default organization; kept on purpose, as above.
• Codex: round 1 added the org switching test (43ae662); round 2 split the access gates (58268f5) and declined the page for create-only roles (needs role-based read; API access stays); round 3 declined two custom-role edges: focus after a delete-only role removes the last skill (deferred accessibility gap), limit-notice delete advice for create-only roles.
• coder-frontend-review of the Codex fixes: fixed CD1, SD1, TN5, TS3, TS5 (617595a); declined TS7 (create-only and delete-only stories add no state) and an RP6 nit (row menu extraction, left as is).

This stack adds organization skills to Coder Agents: admins publish a skill once per organization, share it with groups or members, and chats in that organization load it next to personal and workspace skills.
Stack, bottom to top: #30584, #30585, #30586, #30587, #30588, #30589, #30590, #30591, #30592, #30593, #30594, #30595, #30596, #30597, #30598, #30599, #30600, #30601, #30602, #30603, #30604.

Xum opened this PR on behalf of @ibetitsmike.