feat(studio): add end-to-end Skill creation mode

[yaozheng-fang]

Summary

• add Agent, temporary-session, and Skill-creation modes to the new-chat composer
• use separate SANDBOX_CHAT_CODEX and SANDBOX_SKILL_CREATOR CodeEnv Tools; unavailable modes are disabled with an administrator configuration hint
• create only new Sessions at runtime; run Doubao and DeepSeek Skill candidates in parallel and persist cross-instance status
• stream public reasoning summaries, tool activity, file changes, and final replies into the shared conversation renderer
• keep candidate stage status above the conversation while rendering only Sandbox conversation events below it
• add the Skill Beta badge, model-aware placeholder, consistent tool typography, and the updated new-chat layout
• validate, preview, download, and publish generated Skill archives through AgentKit
• auto-provision two independent Ready CodeEnv Tools during initial cloud deployment when IDs are omitted
• preserve existing cloud environment variables during Studio update and override only explicitly supplied Tool IDs
• include AgentKit Skill center pagination, runtime management layout updates, documentation, and bundled WebUI assets

Security

• keep raw Ark credentials out of the browser, VeFaaS environment, and per-job Session variables
• bind only hosted credential tickets and relay URLs to the dedicated CodeEnv Tools
• require an HTTPS Volcengine credential relay
• redact environment secrets, structured credentials, bearer tokens, and JWTs from failure output
• validate archive paths, symlinks, UTF-8 content, file count, and expanded size

Validation

• frontend tests: 136 passed
• CLI tests: 194 passed
• focused backend regression tests: 73 passed
• Ruff passed
• focused Pyright passed with 0 errors
• frontend and documentation production builds passed
• frontend README Markdown lint passed
• commit hardcoded-secret scan passed
• live temporary chat produced thinking, command lifecycle, and final reply events; the Session was deleted
• live AgentKit A/B generation completed for both models; both candidates succeeded, the ZIP passed integrity validation, and test Sessions were deleted