fix(skills): auto-arm integrity re-check on trust promotion

[bug-ops]

Summary

• Adds [skills.trust] require_integrity_check_on_promote config default (true) that automatically arms requires_trust_check whenever a skill is promoted to trusted/verified, closing the gap where the manual --require-check flag (requires_trust_check per-invocation integrity re-check has zero production setters — inert since #4306 #6080) could be forgotten.
• Applied at both operator promotion sites: CLI zeph skill trust and in-session /skill trust. --require-check/--no-require-check (mutually exclusive) continue to override the config default; promotion to quarantined/blocked leaves the flag untouched.
• The 3-way precedence decision (force-on > force-off > config default) is centralized in a single resolve_require_check function shared by both call sites, closing a gap where only one of two duplicated copies had behavior test coverage (found by adversarial critique during this PR's review).
• Migration step 80 adds a commented advisory for the new key to existing configs that already declare [skills.trust].
• Full integration surface: config default, CLI flag + wizard prompt, migration, CHANGELOG, mdBook docs, both specs/005-skills and specs/010-security spec updates, live-testing playbook extension, coverage-status row.

Self-learning/heuristic auto-promotion and reload trust-assignment are intentionally out of scope — they raise trust levels through different code paths than the two operator-facing handlers touched here. A follow-up issue may be filed to cover them separately.

Closes #6087

Test plan

• cargo +nightly fmt --check
• cargo clippy --profile ci -p zeph-config -p zeph-core -p zeph --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings
• cargo nextest run --config-file .github/nextest.toml -p zeph-config -p zeph-core -p zeph --features "desktop,ide,server,chat,pdf,scheduler,testing" --lib --bins — 3367 passed, 0 failed
• cargo test --doc --workspace (including new resolve_require_check doctest)
• RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features "desktop,ide,server,chat,pdf,scheduler"
• New end-to-end handler-level tests in src/commands/skill.rs: real skill install → real promote via handle_skill_command → real SQLite readback of requires_trust_check, covering both default-arm and --no-require-check override
• Pure-function unit tests on resolve_require_check covering all 4 precedence cases
• Migration step 80 tests: add / no-op-already-present / no-op-absent / no-op-commented / no-op-scanner-subtable / idempotent
• Rebased onto latest origin/main (no conflicts) and re-verified build after rebase