Support runtime-installed custom skills in Docker

[corazzione]

Summary

• install Gateway-uploaded .skill archives into the writable runtime directory under DEER_FLOW_HOME
• load repo skills/public together with runtime skills/custom, and mount them separately in sandbox providers
• keep sandbox path resolution working for /mnt/skills/custom/... and cover the runtime layout with tests

Testing

• .\backend\.venv\Scripts\python.exe -m pytest backend/tests/test_skills_loader.py backend/tests/test_skills_installer.py backend/tests/test_aio_sandbox_provider.py backend/tests/test_sandbox_tools_security.py -q
• .\backend\.venv\Scripts\python.exe -m pytest backend/tests/test_local_sandbox_provider_mounts.py::TestLocalSandboxProviderMounts::test_setup_path_mappings_splits_public_and_runtime_custom_skills -q
• .\backend\.venv\Scripts\python.exe -m ruff check backend/packages/harness/deerflow/skills/loader.py backend/packages/harness/deerflow/skills/installer.py backend/packages/harness/deerflow/sandbox/local/local_sandbox_provider.py backend/packages/harness/deerflow/community/aio_sandbox/aio_sandbox_provider.py backend/packages/harness/deerflow/sandbox/tools.py backend/tests/test_skills_loader.py backend/tests/test_skills_installer.py backend/tests/test_local_sandbox_provider_mounts.py backend/tests/test_aio_sandbox_provider.py

Fixes #1387

[WillemJiang]

@corazzione, thanks for the contribution.

Installing customer skills could introduce a critical security vulnerability, so we don't allow users to install customer skills out of the box.

I am closing this issue for now. We will revisit this feature once we have a more robust method for verifying user skills.