brain approve transacional + external discovery policy

[JonathLima]

What to build

Make brain approve transactional: activates a skill AND updates the inventory in one operation. Enforce external discovery policy.

Scope

• brain.rs: approve_candidate now also writes approved skill to inventory (atomic: move files + update inventory or rollback)
• Reject any _pending skill references in inventory operations
• External discovery: requires explicit policy flag + prior approval with origin, hash, trust, scope fields. BRAIN adapts only when a real skill gap exists, never modifies global skills
• Remove skill scan step after brain approve (inventory already updated by approve_candidate)
• Tests: approve adds to inventory, rollback on failure, external discovery without policy rejected, _pending rejected

Acceptance criteria

• cargo test -p orquestra-skills passes
• brain approve moves skill from _pending to .orquestra/skills/ AND adds to skills_inventory.md
• skill list shows approved skill without requiring skill scan
• External discovery without policy flag is rejected
• BRAIN does not modify global skills (~/.agents/skills/)
• Rollback on failed approve restores prior state

Blocked by

• Session unificada + init ask/answer + memória project-local #4 (Session unificada + init ask/answer + memory)