fix(skills): inject published skills when Auto-approve is off (#6643)

With Auto-approve OFF the agent loop asked get_relevant_skills for
min_confidence=2.0, meant as 'published only'. The gate applies the
confidence check to published skills too, and confidence is 0-1, so no
user skill was ever injected, published or not. The explicit-activation
path already treats OFF as status == published.

Add a published_only flag to get_relevant_skills and pass it from both
callers that used the sentinel (relevance injection and the skill
preflight). Auto-approve ON is unchanged: a skill still needs a passing
audit and the confidence threshold.

Fixes #6634

tests/test_skill_index_toolset_gating.py

@@ -133,3 +133,20 @@ def test_unaudited_or_below_threshold_published_skill_is_not_injected(tmp_path):
     assert not sm.get_relevant_skills(
         "premature skill", min_confidence=0.80,
     )
+
+
+def test_auto_approve_off_injects_published_skills_without_an_audit(tmp_path):
+    # #6634: OFF used min_confidence=2.0, which no 0-1 confidence clears, so
+    # every user skill was rejected. Publishing is the approval when OFF.
+    (tmp_path / "skills").mkdir()
+    for name, status in (("premature-skill", "published"), ("draft-skill", "draft")):
+        path = _write_skill_md(tmp_path / "skills", name)
+        text = path.read_text(encoding="utf-8").replace("audit_verdict: pass\n", "")
+        path.write_text(text.replace("status: published", f"status: {status}"), encoding="utf-8")
+    sm = SkillsManager(str(tmp_path))
+
+    query = "premature skill draft skill"
+    # threshold=0 isolates the eligibility gate from relevance scoring.
+    assert _names(sm.get_relevant_skills(query, threshold=0.0, published_only=True)) == {"premature-skill"}
+    # Auto-approve ON still needs a passing audit, as before.
+    assert not sm.get_relevant_skills(query, threshold=0.0, min_confidence=0.85)