fix(api/skills): sanitize error messages before returning them to clients

[pacocartones]

What & why

The src/app/api/skills/** routes returned the raw error message to the client on a 500:

} catch (err: unknown) {
  const error = err instanceof Error ? err.message : String(err);
  return NextResponse.json({ error }, { status: 500 });
}

skillRegistry reads/writes the skills directory, so a filesystem failure (EACCES/ENOSPC) surfaces an absolute path verbatim to the caller, e.g. EACCES: permission denied, open '/home/<user>/.omniroute/skills/<name>/handler.js'. That's the stack/path leak Hard Rule #12 — and the repo's own sanitizeErrorMessage — already guard against (126 of 175 src/app/api/**/route.ts files sanitize; these skills routes were among the ~49 that didn't).

Change

Route the caught message through sanitizeErrorMessage in the 10 catch blocks across 8 skills routes:

const error = sanitizeErrorMessage(err instanceof Error ? err.message : String(err));

sanitizeErrorMessage is linear-time (CodeQL js/polynomial-redos-clean) and strips stack tails + absolute source paths and redacts sensitive tokens, leaving ordinary messages intact — so the executions route's if (error.includes("disabled")) 503 branch still works.

Scope decisions (deliberate)

• Shape kept as { error: string }, not migrated to buildErrorBody. The omni-skills dashboard reads data.error as a string (OmniMarketplaceTab.tsx:53/83/100/129, OmniSkillsPageClient.tsx:153: (data as { error?: string }).error). Returning { error: { message } } would render [object Object] in the UI. This PR fixes the leak without changing the contract.
• collect/detect/route.ts left untouched — it already uses buildErrorBody.

Files: skills/route.ts, [id]/route.ts (×2), executions/route.ts (×2), install/route.ts, marketplace/route.ts, marketplace/install/route.ts, skillssh/route.ts, skillssh/install/route.ts.

Tests

Adds tests/unit/skills-routes-error-sanitization.test.ts: monkey-patches skillRegistry.loadFromDatabase to throw an error carrying an absolute path, calls GET /api/skills, and asserts the 500 body is still a string and no longer contains the path.

✔ tests/unit/skills-routes-error-sanitization.test.ts — 1 pass

No response-shape change; no public behavior change beyond redacted error text.