Avoid parsing skill metadata rejected by effective policy

[LadyBluenotes]

Problem

Policy-controlled discovery scans skill metadata before applying permission and exclusion rules, doing work for content that will never be exposed.

Evidence

With intent.skills: [] and 100 installed skill packages, listIntentSkills returned zero skills but reported 101 package manifest reads. scanForPolicedIntents calls the raw scanner before policy resolution, and registration discovers skills before filtering.

Sources: scan ordering, registration.

Verified against main at 206e987 (@tanstack/intent 0.3.8), Node v24.12.0 on macOS arm64. Tests used installed dependencies and synthetic local fixtures.

Acceptance criteria

• Measure package reads, skill-file reads, output, and elapsed time before and after on the same fixtures.
• Resolve and validate policy before policy-controlled metadata parsing.
• Agent-visible discovery does not parse denied skill files.
• Preserve traversal needed to locate permitted transitive packages through unlisted parents.
• Preserve human review of hidden candidates and current policy diagnostics through an explicit appropriate discovery path.
• Show identical permitted results and a measured reduction in denied-content work, with no weakening of path or policy checks.

Scope and priority

Priority: Medium. Type: performance.

Follow-up optimization after policy correctness fixes. No persistent cache, broad scanner rewrite, or new dependency solely to optimize this path.