perf(skills): bound self-repair lookup and diagnostic reads

[huangruiteng]

Self-repair currently asks agents to read a large incident catalog and suggests overlapping diagnosis/status/quota/history calls. This makes recovery consume context and repeat potentially expensive commands before reaching the relevant evidence.

This S10 delivery keeps the original catalog unchanged and adds a standard-library, skill-local BM25 lookup with exact ID/code precedence, bounded pages, complete selected guidance and visible unmatched terms. The workflow starts from the existing failure response, chooses the missing fact, and reuses one captured response without treating it as fresh write authority. These consumer-side practices apply to every provider; the PR changes no provider storage, lease, CAS or settlement rules.

AGENTS.md now routes recurring performance problems to the existing testing guide: map the evidenced gap to roadmap/RFC acceptance, separate caller/shared/provider costs, preserve authority, and distinguish mitigation from long-running qualification. The bilingual guide defines measurement and provider-validation boundaries without a new gate or parallel RFC.

The managed installer, wheel data declarations and doctor expectations deliver the lookup together. Existing install assertions are aligned with the current read-only handoff wording. No frontend companion is needed: the changed entry points are the installed workflow skill and its local lookup script; no UI/API configuration changed.

Validation:

• 15 focused lookup tests, including literal/partial terms, exact matches, pagination, malformed input, lossless guidance and real workflow-skills CLI installation followed by execution without LoopX on PATH.
• 58 existing workflow/metadata/delivery/doctor tests; escalation, interaction-catalog and vision-contract smokes; Ruff and skill validation.
• Full local installation smoke and semantic-vocabulary smoke passed after repairing stale handoff-text assertions and installing the declared local TypeScript dependency.
• A small, manually labeled 10-query sanity set improves Hit@1 and Hit@3 from 6/10 with strict AND to 9/10 with fixed-parameter BM25. The under-specified query remains in the fixture; this is not a production-accuracy claim. Example search plus full expansion returns about 3 KB instead of reading the 218 KB corpus, at roughly 53 ms in one local environment.
• Premerge on the unchanged runtime head 2e1db80b127d9172d6fd97ce36f58fa53711bf45 passed its other executable checks, but the full install smoke exceeded the default 120-second wrapper. The same full smoke subsequently passed in an isolated timed run in 160.23 seconds with a 300-second observation cap. The default timeout has not been changed; this draft retains an installation-timing hold and does not claim merge readiness.
• The premerge run also reported a stale change-quality receipt after a rejected evidence reference. That reference was corrected and qualification was recorded and verified separately against final head 713fb8229c973bd240da3bcb27786eccfedfe8f5; the final follow-up changes only AGENTS.md and the testing guide. Documentation links, the new heading anchor, public boundary scan and diff checks passed; the full premerge suite was not rerun afterward.

The future-facing pass keeps a single catalog and uses the existing installer instead of adding a capability, index service or provider cache. Provider latency/capacity qualification remains separate: this does not claim to solve File journal rewrite amplification or replace the existing write-timeout work in #5063. Private session evidence and read-only Goal snapshots are excluded.