Add project-scoped skill metadata filtering

Problem

Claude Code injects the global skill catalogue metadata into the session prompt, but project-level skill permissions do not reduce that metadata cost.

In our measured setup, a new Claude Code session injected 122 skill entries, about 31,793 bytes of metadata. Many entries are irrelevant in a given project or workstream. Example: a career-tracking session does not need ML training, Minecraft server, weather report, or Firecrawl SDK integration skills in the prompt.

Current behavior

There are two existing mechanisms, but neither solves per-project prompt bloat:

1. disable-model-invocation: true in a skill's frontmatter removes the skill from Claude's context entirely, but it is global. It is not safe for skills that are irrelevant in one project and useful in another.
2. Skill(name) permission deny in project settings blocks invocation, but does not remove the skill metadata from the system prompt, so it does not reduce token or attention cost.

This makes project-local curation impossible without globally hiding skills.

Requested behavior

Please add a project-level setting that removes skill metadata from the prompt for that project. For example:

{
  "enabledSkills": ["test-driven-development", "github-pr-workflow"],
  "disabledSkills": ["minecraft-modpack-server", "pytorch-fsdp"]
}

The exact schema is flexible. The key requirement is that the filtering happens before the skill catalogue is rendered into the model context, not only at invocation time.

Why this matters

Large cross-project skill catalogues hurt model focus and waste context. This is especially painful for users who use Claude Code across unrelated workstreams, such as engineering repos, notes, personal admin, research, and local ops.

OpenAI Codex already has two useful primitives here:

• repo-scoped skill discovery via repo-local .codex/skills/
• a skills metadata context budget cap with graceful description truncation

Claude Code already has the global frontmatter mechanism that proves metadata removal is possible. The missing piece is per-project scope.

Prior issue context

This is related to #37463, which was closed and locked on March 30, 2026. The likely confusion is that permission rules solve invocation control, but not metadata cost. This request is specifically about reducing the system prompt metadata.

Acceptance criteria

• A project can hide or allowlist skills before the skill catalogue is injected into the model context.
• The behavior is project-scoped, not global to the user's full Claude Code installation.
• Documentation distinguishes metadata filtering from invocation permission denial.