fn register_skill_catalog_unbind(engine: &Arc<WshRpcEngine>, state: &AppState)Expand description
Catalog-tier sibling of skill.unbind (above) — same DB write, no
check_s1. Restricted to global rows only, matching the guard
register_skill_catalog_bind/register_skill_catalog_delete already
apply in this file: any window connection can sever any agent’s binding
to a global skill (an intentional, pre-existing trust boundary — bind
and delete already have the same or larger blast radius), but a private
row’s own binding must not be touchable via this no-check_s1 surface,
even though skill_id is never exposed by any no-check_s1 command
today — defense in depth over relying solely on UUID secrecy.
reagentx P1 on PR #2329 (round 2).