feat(mosaic): IUV-M02 — CORS/FQDN UX polish + skill installer rework (#437)

IUV-02-01: Replace raw CORS origin prompt with a friendly hostname input
- Add `deriveCorsOrigin(hostname, webUiPort, useHttps?)` pure function
- Prompt asks "Web UI hostname" (default: localhost) instead of "CORS origin"
- Auto-detects http vs https: localhost/127.0.0.1 always http, remote defaults to https
- For remote hosts, asks "Is HTTPS enabled?" (defaults to yes)
- Headless: MOSAIC_HOSTNAME env var as friendly alternative to MOSAIC_CORS_ORIGIN
- GatewayState gains optional `hostname` field to track the raw input
- Fallback paths now read GATEWAY_CORS_ORIGIN from .env instead of hardcoding

IUV-02-02: Diagnose skill installer failure modes (documented in PR body)
- Selection → installation gap: syncSkills() ignored state.selectedSkills entirely
- Silent failure: missing catalog directory had no user-visible error
- No per-skill granularity: all-or-nothing rsync with no whitelist concept

IUV-02-03: Rework skill installer end-to-end
- syncSkills() now accepts selectedSkills[] and passes MOSAIC_INSTALL_SKILLS
  (colon-separated) to the bash script
- Script filters linking to only the whitelisted skills when MOSAIC_INSTALL_SKILLS is set
- Missing script surfaced clearly instead of silently swallowed
- Non-zero exit captured from stderr and shown to the user
- Post-install summary reports "N installed" or failure reason

IUV-02-04: Tests + gates
- 13 unit tests for deriveCorsOrigin covering localhost, remote, https override
- 5 integration tests for finalize skill installer (selection, skip, failure, missing script)
- pnpm typecheck + lint + format:check all green
- 237 tests passing (26 test files)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/mosaic/framework/tools/_scripts/mosaic-sync-skills

@@ -7,6 +7,11 @@ SKILLS_REPO_DIR="${MOSAIC_SKILLS_REPO_DIR:-$MOSAIC_HOME/sources/agent-skills}"
 MOSAIC_SKILLS_DIR="$MOSAIC_HOME/skills"
 MOSAIC_LOCAL_SKILLS_DIR="$MOSAIC_HOME/skills-local"
 
+# Colon-separated list of skill names to install.  When set, only these skills
+# are linked into runtime skill directories.  Empty/unset = link all skills
+# (the legacy "mosaic sync" full-catalog behavior).
+MOSAIC_INSTALL_SKILLS="${MOSAIC_INSTALL_SKILLS:-}"
+
 fetch=1
 link_only=0
 
@@ -25,6 +30,7 @@ Env:
   MOSAIC_HOME               Default: ~/.config/mosaic
   MOSAIC_SKILLS_REPO_URL    Default: https://git.mosaicstack.dev/mosaic/agent-skills.git
   MOSAIC_SKILLS_REPO_DIR    Default: ~/.config/mosaic/sources/agent-skills
+  MOSAIC_INSTALL_SKILLS     Colon-separated list of skills to link (default: all)
 USAGE
 }
 
@@ -156,6 +162,27 @@ link_targets=(
 
 canonical_real="$(readlink -f "$MOSAIC_SKILLS_DIR")"
 
+# Build an associative array from the colon-separated whitelist for O(1) lookup.
+# When MOSAIC_INSTALL_SKILLS is empty, all skills are allowed.
+declare -A _skill_whitelist=()
+_whitelist_active=0
+if [[ -n "$MOSAIC_INSTALL_SKILLS" ]]; then
+  _whitelist_active=1
+  IFS=':' read -ra _wl_items <<< "$MOSAIC_INSTALL_SKILLS"
+  for _item in "${_wl_items[@]}"; do
+    [[ -n "$_item" ]] && _skill_whitelist["$_item"]=1
+  done
+fi
+
+is_skill_selected() {
+  local name="$1"
+  if [[ $_whitelist_active -eq 0 ]]; then
+    return 0
+  fi
+  [[ -n "${_skill_whitelist[$name]:-}" ]] && return 0
+  return 1
+}
+
 link_skill_into_target() {
   local skill_path="$1"
   local target_dir="$2"
@@ -168,6 +195,11 @@ link_skill_into_target() {
     return
   fi
 
+  # Respect the install whitelist (set during first-run wizard).
+  if ! is_skill_selected "$name"; then
+    return
+  fi
+
   link_path="$target_dir/$name"
 
   if [[ -L "$link_path" ]]; then