feat: surface capability audit records

[seekskyworld]

Issue link:

• docs/maka-capability-audit-v1.md §7 Sources / Skills / Automations visible system

Summary:

• Add @maka/core capability audit records for Sources, Skills, and Automations.
• Derive local workspace skill source state, read-first skill permission modes, and plan-reminder automation status from existing snapshots.
• Surface a shared capability audit strip on the Skills and Automations module pages.
• Align docs/design-system.md §9.10 with the implemented audit contract and current test gates.

Motivation:

• Maka already lists local skills and scheduled reminders, but users could not audit source readiness, declared skill tools, or automation run state in one visible contract.
• Skill declared tools remain permission requests only; this PR keeps them from widening execution permission.

Validation:

• npm --workspace @maka/core run test
• npm --workspace @maka/ui run typecheck
• npm --workspace @maka/desktop run test -- capability-audit-ui-contract
• npm run typecheck --workspaces --if-present
• git diff --check