[Feat]: CLI config and three-tier skill path resolution (global + project)

[rosspeili]

Feature Description

Add persistent CLI configuration (global + per-project) and wire three-tier skill path resolution through the loader and all CLI commands that scan disk.

Tiers (aligned with #234 / trust doc vocabulary):

Tier	Source	Default behavior
Bundled	PyPI wheel site-packages/skills/	Always on; read-only in config
Project	Repo ./skills/ or explicit project root	Auto-detect via walk-up; overridable in project config
External	User-added directory(ies)	Optional; operator responsibility

Config files (v1 — names negotiable in PR):

• Global: ~/.config/skillware/config.yaml (or OS-appropriate XDG path)
• Project: .skillware.yaml in repo root (walk up from cwd)

Schema sketch (v1):

paths:
  project: auto
  external: []
resolution:
  order: [project, external, bundled]
legacy:
  honor_skillware_skill_path: true

Behavior:

• All configured roots are scanned when resolving a registry ID; first match wins unless RFC changes policy.
• Bundled skills remain available when project/external do not shadow the same ID.
• When project or external overrides bundled for the same ID, emit a clear warning ([Feat]: Skill load trust tiers — origin metadata and warnings for non-bundled skills (sub-issue of #17) #110).
• Failed load: error lists tier, roots searched, and tip (skillware paths, config location).
• skillware list, skillware test, and SkillLoader.load_skill() use the same discovery helper (extend module from [Feat]: CLI commands to set and repair skill directory paths (sub-issue of #16) #81).

Out of scope:

• URL/git external roots ([Feat]: Explore external skills registry layout and promotion path #241)
• SKILL.md / soft skills in external trees ([Feat]: Explore SKILL.md import path for external soft skills #240)
• Interactive path editing UI ([CLI]: Interactive paths editor and grouped help submenus #247)
• Themes ([CLI]: User-configurable themes and presentation settings #248)
• PyPI wheel packaging changes ([RFC]: Install model — one wheel, category and skill dependency extras #236)

Rationale

Rationale

Today roots are implicit (SKILLWARE_SKILL_PATH → cwd walk → bundled). Operators cannot see or persist project vs external paths; shadowing is silent. Pip-only users need bundled registry as a reliable default; project teams need scoped ./skills/; power users need external folders.

This is the backend for: bundled read-only default, optional project/external paths, multi-root scan, conflict visibility, and consistent errors across CLI and library.

Affected paths (optional)

skillware/core/discovery.py, skillware/core/loader.py, skillware/core/config.py, skillware/cli.py, tests/test_loader.py, tests/test_cli.py, tests/test_discovery.py, docs/usage/cli.md, docs/usage/README.md, docs/security/skill-trust-model.md, docs/contributing/ai_native_workflow.md

Implementation Idea

Implementation Idea

1. Config module — load global → project (walk-up) → env merge rules.
2. Extend discovery.py — get_skill_roots(config) with tier label, path, skill IDs.
3. Loader — _all_skill_roots() reads config; backward compat when no config file.
4. Shadowing helper — warn when project/external overrides bundled.
5. Optional skillware config show (read-only; editor is [CLI]: Interactive paths editor and grouped help submenus #247).
6. Tests with tmp_path: global config, project .skillware.yaml, env var, bundled fallback, shadow warning.
7. Docs — path resolution in cli.md; trust doc cross-link ([Docs]: Operator expectations for bundled vs external skills #243).

Acceptance criteria

• Global and project YAML config load and merge predictably (document precedence).
• Bundled wheel root always included; not writable via config.
• Project + external roots participate in load_skill, list, test.
• Shadowing produces operator-visible warning ([Feat]: Skill load trust tiers — origin metadata and warnings for non-bundled skills (sub-issue of #17) #110 minimal v1).
• Skill-not-found errors list searched roots/tiers with actionable tip.
• SKILLWARE_SKILL_PATH documented when config also present.
• Tests cover config merge, shadowing, CLI/loader parity.
• docs/usage/cli.md and trust doc updated.

[rosspeili]

Hey @rizzoMartin, there's a bunch of CLI reworking happening rn. Thought you might be interested in picking some relevant issues? We also have a new issue template for CLI specifically for better filtering. If you haven't already, update to latest 0.4.3 version to see the new cli atm. <3