fix(skills): a library skill marked user-invocable: false is reported that way (#3134)

[vybe]

Fixes #3134 — independent fix, one of ten small bug fixes in the trinity-pm chain-easy-1008 run. Base is dev. Draft until the operator merges.

What

• src/backend/services/skill_packaging.py::extract_contract: user_invocable is read with the existing _first_present(sources, ("user-invocable", "user_invocable")). A library skill marked user-invocable: false (the Claude Code frontmatter spelling, the only one the agent server reads) is now reported user_invocable: false on GET /api/skills/library and MCP list_skills. The wire name stays user_invocable; the underscore spelling keeps working.
• Precedence: a trinity: block wins over both flat spellings, whichever spelling it uses; within one level the hyphen wins; a present-but-null key does not hide the other spelling; a non-bool still reads as True.
• Docs: docs/memory/feature-flows/skill-injection.md, docs/memory/requirements/skills.md, and docs/user-docs/automation/skills-and-playbooks.md (the user doc taught the underscore spelling, which the agent server never reads).
• Tests: eight cases in tests/unit/test_ent183_skill_packages.py.

Rulings carried (orchestrator, on the operator's behalf — plan file)

• TD-1: _first_present over the sources, not the issue's suggested one-liner — as recommended. The one-liner reads the merged dict, so a flat hyphen key would beat a trinity: block that uses the underscore, breaking the acceptance criterion "a trinity: block still wins". The sweep confirmed it: with the one-liner in place, two of the eight cases fail.
• TD-2: real booleans only — as recommended.
• TD-3: the same cross-spelling flaw in allowed-tools stays out — as recommended; see Handoffs.

Review + security

/review reading pass (claude-fable-5-1, report-only): MERGEABLE, zero critical. Every reader of the platform-side flag is display or catalog only (Library → Skills chip, the agent Skills tab chip, MCP list_skills). Everything that gates execution, connector exposure or portal hints reads the agent server's own parser, which this branch does not touch; assignment never consults the flag. /cso --diff: no findings.

Correction to the issue (review I1): on the library's current tip only project-intake carries user-invocable: false. adjust-playbook is explicitly true and skill-builder has no key. One chip flips, not three.

Fixed after review: d44b207a — I2, the user-doc line.

Evidence sweep after the fix (claude-opus-5-5): all 10 unit files that import skill_packaging ran shuffled (seed 12345), one file per process — 387 passed, 1 failed. The failure is test_ent236_skills_lifecycle.py::TestNonRepoDirectoryRecovers::test_real_repo_still_pulls ('cloned' == 'pulled'). It fails the same way on dev f6bedcd on the engineer, without shuffling, and it tests skill_source_clone, which this branch does not change; it looks environment-dependent (real git against the test's empty fake .git). The builder marked the sweep RED on principle; nothing this branch touches is red. With dev's parser, four of the eight spelling cases fail. git merge-tree against dev is clean.

Tests

Counts above. Not run here: the full unit island (CI).

Before merge

• Merge-order call: this branch conflicts with open PR feat(skills): one Skills tab — own and shared skills, Run, Requires approval (abilityai/trinity-enterprise#754) #3412 (feature/754-skills-tab-merge) in docs/user-docs/automation/skills-and-playbooks.md — a one-line edit here against that PR's rewrite of the same section. Whichever lands second keeps the hyphen spelling user-invocable: on that line. feat(skills): one Skills tab — own and shared skills, Run, Requires approval (abilityai/trinity-enterprise#754) #3412's edits to the two docs/memory files merge cleanly, as does fix(url-validation): a token in a protocol-relative skills-library URL is refused, not stored (#3323) #3420's edit to the shared test file.
• Read CI's backend run for test_real_repo_still_pulls: if it is green there, the failure above is the engineer's environment only.

Handoffs (not in this diff)

• allowed-tools (skill_packaging.py, around line 208) has the same cross-spelling flaw.
• abilityai/trinity-skills tools/validate.py runs a copy of this parser pinned by SHA. It asserts only on frontmatter_invalid* warnings, so nothing it expects changes; the library picks the new behaviour up when that pin moves.

🤖 Generated with Claude Code

[trinity-ability]

merge-train: batch validated on train/20261009-0735 (#3424)