Merge branch 'stack/agent-profiles-5-web-ui' into stack/agent-profiles-8-authoring

# Conflicts:
#	apps/cli/tests/web-agent-presets.e2e.ts
#	packages/client/connection/README.i18n.yaml
#	packages/client/connection/README.md
#	packages/client/connection/README.zh.md
#	packages/client/ui-conversation/src/client/contract/slots.ts
#	packages/client/ui-primitives/tests/icons.spec.tsx
#	packages/client/ui-settings/src/client/contract/slots.ts
#	packages/host/apiproxy/tests/api-proxy-agent-preset.spec.ts

apps/cli/config/agent-presets/code/agent.cordis.yml

@@ -84,20 +84,16 @@
 
 # ── skills ──────────────────────────────────────────────────────────────────
 
-- id: skills
-  name: cordis:group
-  group: true
-  isolate:
-    skills: true
-  config:
-    - id: skill
-      name: '@deepseek-ai/dsh-skill'
+# The skill REGISTRY lives in the host composition and is layered per scope:
+# these rows register into THIS preset's layer of it, so they need no realm.
+# `skill-local` contributes local-root discovery for agents on this preset, and
+# `tool-skill` gives them the catalog and loader; the merged catalog also
+# carries whatever the deployment registered globally (repository plugins).
+- id: skill-local
+  name: '@deepseek-ai/dsh-skill-local'
 
-    - id: skill-local
-      name: '@deepseek-ai/dsh-skill-local'
-
-    - id: tool-skill
-      name: '@deepseek-ai/dsh-tool-skill'
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'
 
 # ── goals ───────────────────────────────────────────────────────────────────
 

apps/cli/config/agent-presets/cordis/agent.cordis.yml

@@ -227,20 +227,14 @@
 # in the user's skill root: it documents THIS deployment's two planes, and a
 # preset is the unit that gets copied and edited. `baseUrl` is the preset's
 # own directory, so the root resolves wherever the preset is installed.
-- id: skills
-  name: cordis:group
-  group: true
-  isolate:
-    skills: true
+# Both rows register into THIS preset's layer of the host skill registry, so
+# they need no realm; the agent's merged catalog also carries whatever the
+# deployment registered globally (repository plugins).
+- id: skill-local
+  name: '@deepseek-ai/dsh-skill-local'
   config:
-    - id: skill
-      name: '@deepseek-ai/dsh-skill'
+    customSkillDirs:
+      - !!js "process.getBuiltinModule('node:url').fileURLToPath(new URL('skills/', baseUrl))"
 
-    - id: skill-local
-      name: '@deepseek-ai/dsh-skill-local'
-      config:
-        customSkillDirs:
-          - !!js "process.getBuiltinModule('node:url').fileURLToPath(new URL('skills/', baseUrl))"
-
-    - id: tool-skill
-      name: '@deepseek-ai/dsh-tool-skill'
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'

apps/cli/config/agent-presets/cordis/skills/editing-cordis-compositions/SKILL.md

@@ -37,24 +37,24 @@ Whether a row publishes a service is not visible from its name. `tool-bash` read
 When a preset genuinely owns a service, wrap the provider **and every consumer that reaches it** in one group carrying an `isolate` realm:
 
 ```yaml
-- id: skills
+- id: tasks
   name: cordis:group
   group: true
   isolate:
-    skills: true
+    tasks: true
   config:
-    - id: skill
-      name: '@deepseek-ai/dsh-skill'
-    - id: skill-local
-      name: '@deepseek-ai/dsh-skill-local'
-    - id: tool-skill
-      name: '@deepseek-ai/dsh-tool-skill'
+    - id: tasks-local
+      name: '@deepseek-ai/dsh-tasks-local'
+    - id: tool-tasks
+      name: '@deepseek-ai/dsh-tool-tasks'
 ```
 
 `true` means a realm private to each mounting session. A string label instead pools one instance across every subtree naming that label — use it only for something genuinely expensive to duplicate.
 
 A consumer left outside the group resolves the host's registry, which the preset did not populate, and then contributes nothing. That is the quietest failure here: the mount succeeds and a tool is simply missing.
 
+Registry-shaped host capabilities need no realm at all: the host `tools` and `skills` registries are layered per scope, so rows like `skill-local` and `tool-skill` sit loose in the preset and their registrations file into this preset's layer automatically — the agent's catalog merges them with whatever the deployment registered globally.
+
 ## Verifying a change
 
 Read the live runtime with `cordis_inspect` — it reports the services, the plugin fibers, and the registered tools as they actually are, which is the only reliable check that a row did what its name suggests. Note it shows THIS session's composition: a preset you just wrote is not mounted anywhere until a session starts on it.

apps/cli/config/agent-presets/standard/agent.cordis.yml

@@ -77,20 +77,16 @@
 
 # ── skills ──────────────────────────────────────────────────────────────────
 
-- id: skills
-  name: cordis:group
-  group: true
-  isolate:
-    skills: true
-  config:
-    - id: skill
-      name: '@deepseek-ai/dsh-skill'
+# The skill REGISTRY lives in the host composition and is layered per scope:
+# these rows register into THIS preset's layer of it, so they need no realm.
+# `skill-local` contributes local-root discovery for agents on this preset, and
+# `tool-skill` gives them the catalog and loader; the merged catalog also
+# carries whatever the deployment registered globally (repository plugins).
+- id: skill-local
+  name: '@deepseek-ai/dsh-skill-local'
 
-    - id: skill-local
-      name: '@deepseek-ai/dsh-skill-local'
-
-    - id: tool-skill
-      name: '@deepseek-ai/dsh-tool-skill'
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'
 
 # ── goals ───────────────────────────────────────────────────────────────────