Feature request: hook scope limited to a skill's active execution period (not just `once: true`)

Summary

Following up on #82801 (closed as "working as documented" — skill-frontmatter hooks
intentionally persist for the rest of the session once registered), filing the
enhancement request the maintainer (@bcherny) invited: a way to scope a skill's
hooks strictly to that skill's own active execution period, similar to how
subagent hooks already work.

Problem

Skill hooks currently have exactly two lifetimes:

1. Default: registered on first invocation, then active for the rest of the

session (every subsequent turn, whether or not the skill runs again).

1. once: true: fires exactly once total across the whole session, then the

hook is removed.

Neither models "active only while this skill is doing its own work." A hook may
need to fire for every matching tool call during one invocation of the skill
(potentially many calls), then go inert as soon as that invocation's turn ends —
but fire again, fully, the next time the skill is invoked. once: true can't do
this: it caps total firings across the whole session at one, so a second
invocation of the same skill gets no protection at all, and even within a single
invocation, only the very first matching tool call is caught if the skill makes
more than one.

Motivating use case

A read-only audit/review skill that wants to PreToolUse-deny write-capable
tools (Write/Edit/Bash file writes) only while it is actively running, without
affecting unrelated tool calls in later turns or other skills' turns, and
without needing to duplicate that guard permanently in settings.json (which
would block writes globally, not just during this skill's own execution).

Proposed behavior

Give skill hooks a lifecycle option equivalent to what subagent hooks already
have: registered when the skill is invoked, automatically removed when that
invocation's turn ends (true per-invocation scoping), instead of surviving for
the rest of the session. This could be an opt-in field alongside once, e.g.
scope: invocation (name negotiable), so the current session-wide default
stays unchanged for skills that rely on it.

Why once: true doesn't cover this

once: true limits total number of firings across the session, not
duration of effect. It doesn't reset between separate invocations of the same
skill, and it doesn't cover multiple tool calls within a single invocation.

Related: #82801, #30874