fix(#2665): walk skillsHome.env on both descriptor rungs of the scrub derivation

Review round 4, Minor 3. A configHome descriptor can nest a second,
independently-resolved descriptor (skillsHome -> resolveSkillsBaseFromDescriptor)
carrying its own env array, and the derivation walked configHome.env alone —
the identical walk-one-field gap-shape rounds 2-3 closed for the registry
and the non-registry set. Inert today (only kilo declares skillsHome, with
env: []), closed before it is live rather than after.

The guard's root enumeration deliberately does NOT gain the skills base:
getGlobalSkillsBase returns a skills directory (codex: ~/.agents/skills),
not a config root, and the snapshot applies the config-root layout beneath
every root — adding it false-positives on <skillsBase>/gsd-core while
missing a real <skillsBase>/gsd-help write (found by this round's pre-push
adversarial review). Watching skills bases needs its own layout, like
resolveExtraWatchTargets; a comment in resolveLiveConfigRoots records the
non-action.

New derivation test asserts both skillsHome rungs land in TEST_ENV_BASE,
with an anti-vacuity check that at least one runtime actually declares the
field.

scripts/live-config-guard.cjs

@@ -116,6 +116,14 @@ function resolveLiveConfigRoots(deps = {}) {
 
   const roots = new Set();
   // 'grok' is a hardcoded branch of getGlobalConfigDir with no registry entry.
+  //
+  // DELIBERATE NON-ROOT: getGlobalSkillsBase(runtime) is NOT added here. The
+  // skills base (e.g. codex's ~/.agents/skills) is not a config ROOT, and the
+  // snapshot applies the config-root layout (GSD_OWNED_ENTRIES x
+  // GSD_PREFIXED_PARENTS) beneath every root it is given — measured on a
+  // sandboxed HOME, adding it both false-positives on `<skillsBase>/gsd-core`
+  // and misses a real `<skillsBase>/gsd-help` write. Watching skills bases
+  // needs its own layout, like resolveExtraWatchTargets — a separate change.
   for (const runtime of [...Object.keys(runtimes || {}), 'grok']) {
     try {
       const dir = getGlobalConfigDir(runtime);