feat(start): auto-register workdir-local skills with no required secrets/fields on omac start #136

What

Add a --auto-register-skills flag to omac start that silently registers discovered workdir-local skills whose omac.yaml declares no required secrets and no required config fields, instead of refusing to start. Skills with required secrets/fields still surface via the existing findUnregisteredSkills gate so the user is prompted for values.

Why

omac start hard-fails with ExitPrerequisiteMissing whenever a discovered skill directory has an omac.yaml but no entry in .opencode/sidecar.json. The registry is deliberately gitignored (commit c5ef7cd — per-environment state), so every fresh clone / worktree / Superset workspace of a repo that ships committed skill bundles forces an interactive omac register <skill> before the agent can start.

This bites the omac repo itself (ships .opencode/skills/{echo-rest,self-audit} with omac.yaml, registry gitignored) on every fresh workspace. It also bites any downstream repo that ships example/test skills the same way. omac serve already has an autoRegister path (serve.go:1206); omac start does not.

The current workaround — running omac register manually each time — is friction the user has hit repeatedly and tried to fix before. A flag mirrors serve's behaviour and lets launchers (e.g. the personal oco wrapper) opt in without forcing interactive prompts on every workspace.

How

• Add --auto-register-skills to the omac start / omac continue / omac resume shared launch flags (launchOpts + parseLaunchArgs).
• Before the findUnregisteredSkills gate (start.go:~314), when the flag is set: scan discovered workdir-local skills (Kind == "workdir"), and for each that is absent from the registry AND whose omac.yaml sidecar declares no required secrets and no required config fields, write a registry entry mirroring serve.go's autoRegister (bundle hash, declared secret names, relative SkillDir under the workdir).
• Skills WITH required secrets/fields are NOT auto-registered — they still surface via the gate so the user is prompted. Auto-registration never silently skips a registration prompt that would otherwise have asked for a value.
• After auto-registering, reload the workdir registry and re-merge so the gate and the rest of runLaunch see the freshly-registered skills.
• Scope is workdir-local only; user-global skills continue to be registered once, globally, via omac register --global.

Non-goals

• Changing the gitignore policy for .opencode/sidecar.json (stays per-environment by design).
• Auto-registering skills with required secrets/fields (those still prompt).
• Backfilling the Superset SUPERSET_* routing vars into the compiled-in DefaultAllowVars — that stays a per-user profile edit since Superset is a single-user deployment for now (tracked separately in the user's personal tng-customized.json).

Verification

• New tests in internal/cli/start_autoregister_test.go: eligibility predicate (no sidecar / optional-only / required secret / required field), the auto-register flow (only eligible skills registered, required-value skills still surfaced by the gate), already-registered skip, user-global skip.
• gofmt -l clean, go vet clean.
• go test ./internal/cli/ ./internal/sandboxprofile/ — all new + existing tests pass (one pre-existing sandbox-artifact failure, TestDoctorHarnessBinarySection, fails identically on the clean tree because it reads the user's real ~/.config/omac/config.yaml).
• omac start --help shows the new flag.