feat(run): add --no-skills opt-out

[bferanmi806-sketch]

Summary

Closes #338

Adds a shared --no-skills option to both agent-vault run and agent-vault vault run.

• By default, recognized host-mode agents keep the existing automatic skill installation/update behavior.
• With --no-skills, the skill file is not created or modified.
• OpenClaw proxy configuration remains independent and still runs when --no-skills is supplied.
• Container execution is unchanged; the option is scoped to host-mode skill-file installation.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation
• CI / build

Test plan

• Existing tests pass (make test): the suite reaches all packages but the existing internal/isolation.TestAssetsHash_Stable assertion fails (got 530f92080947, want 0cf46302069b); no isolation asset files are changed here.
• Added/updated tests for new behavior
• Manual testing (both built CLI forms display --no-skills with the expected help text)

Validation:

• gofmt -w cmd/run.go cmd/run_test.go passed with Go 1.25.
• go test ./cmd -count=1 passed.
• go test ./... -count=1 reached all packages and has only the pre-existing isolation asset-hash failure described above.
• go vet ./... passed.
• git diff --check passed with native Windows Git.
• make test reproduces the same pre-existing isolation asset-hash failure.
• make lint was attempted but could not start because golangci-lint is not installed; the frontend TypeScript step was not reached.
• The Linux build completed successfully; the SQLite C compiler emitted its existing discarded-qualifier warning.

Security checklist

• No secrets or credentials in code
• No new unauthenticated endpoints
• Input validation on new API surfaces (no new API surface; the option is a Cobra boolean flag)
• Checked for OWASP top 10 (injection, XSS, etc.)

[infisical-cla-app]

✅ CLA satisfied. All contributors have signed the current CLA. The cla/signed check is passing.

[greptile-apps]

Greptile Summary

The PR adds a shared --no-skills option to both run command forms, allowing users to disable host-mode Agent Vault skill installation and updates while preserving OpenClaw proxy configuration.

• Registers the opt-out on the shared run command constructor.
• Gates skill-file writes without changing container execution.
• Adds filesystem behavior tests and updates CLI and agent quickstart documentation.

Confidence Score: 5/5

The PR appears safe to merge with no concrete functional or security defects identified.

Both CLI forms share the correctly registered flag, the opt-out prevents skill-file writes in host mode, container behavior remains unchanged, and OpenClaw proxy configuration remains independent as documented.

Important Files Changed

Filename	Overview
cmd/run.go	Adds the shared flag and correctly limits its effect to host-mode skill installation while leaving OpenClaw configuration reachable.
cmd/run_test.go	Verifies both command forms expose the flag and confirms enabled and disabled filesystem behavior.
docs/reference/cli.mdx	Documents the new flag, default value, and host-mode scope consistently with the implementation.
docs/quickstart/openclaw.mdx	Clarifies that the opt-out skips skill writes but does not disable OpenClaw proxy configuration.

_{Reviews (1): Last reviewed commit: "feat(run): add skill installation opt-ou..." | Re-trigger Greptile}