Skill resolver should warn on ambiguous name resolution (local command shadows plugin skill)

Problem

When a local .claude/commands/X.md exists alongside a plugin skill with the same short name (plugin:X), Skill(skill="X") silently resolves to the local file. The plugin version is never loaded. No warning is emitted.

This is not a rare edge case. In one production repo with 20 local commands and 5 installed plugins (64 plugin skills), 15 out of 20 local commands shadow plugin skills by name. Every invocation of those 15 skills loads the legacy local file instead of the hardened plugin version.

Evidence

Forensic analysis of a real session (JSONL fingerprinting) confirmed that Skill(skill="qa-guide") loaded .claude/commands/qa-guide.md instead of qa-validation:qa-guide. The local file was a legacy command missing critical safeguards present in the plugin version. The session lasted 5 hours with no usable output.

The loaded content was verified byte-for-byte against both files: exact match with the local command (8226 chars after $ARGUMENTS resolution), zero overlap with the plugin skill content.

Requested Behavior

When the Skill resolver finds multiple candidates for a short name, emit a visible warning:

Warning: Skill "qa-guide" resolves to local .claude/commands/qa-guide.md
         but also matches plugin qa-validation:qa-guide.
         Using local version. To use the plugin: Skill(skill="qa-validation:qa-guide")

This matches how package managers handle shadowed dependencies (npm warns, pip warns, DNS has explicit precedence).

Environment

• Claude Code 2.1.100 (VS Code extension)
• Platform: Linux and Windows 11
• Plugins: ai-agency-kit (quality, github-operations, pr-review, security-audit, product), moavi-claude (github-operations, observability-suite, qa-validation)