feat(config,policy): skill sets per kind, master without vault skills, attachments in the vault, crons in local tz

tests/test_policy.py

@@ -4,7 +4,14 @@ from pathlib import Path
 import pytest
 from beaver_gateway.core.policy import Deny, ToolCall
 
-from policy import Zones, bash_zones, requires_skill, skill_tracker, vault_zones
+from policy import (
+    Zones,
+    bash_zones,
+    forbid_skills,
+    requires_skill,
+    skill_tracker,
+    vault_zones,
+)
 
 
 @pytest.fixture
@@ -24,12 +31,14 @@ def zones(vault: Path) -> Zones:
     )
 
 
-def call(vault: Path, tool: str, state=None, **tool_input) -> ToolCall:
+def call(
+    vault: Path, tool: str, state=None, kind: str = "master", **tool_input
+) -> ToolCall:
     return ToolCall(
         tool=tool,
         input=tool_input,
         agent="a",
-        kind="master",
+        kind=kind,
         conversation="c",
         cwd=vault,
         state=state if state is not None else {},
@@ -117,6 +126,18 @@ def test_firefly_requires_open_skill(vault):
     assert gate(store) is None
 
 
+def test_forbid_skills_only_named_kinds_and_only_skill_tool(vault):
+    rule = forbid_skills(("firefly", "beaver *"), kinds=("master", "job"))
+    deny = rule(call(vault, "Skill", skill="vault:firefly"))
+    assert isinstance(deny, Deny)
+    assert deny.reason == "скилл firefly недоступен в master: открой ветку"
+    assert rule(call(vault, "Skill", kind="job", skill="Beaver Durden")) is not None
+    assert rule(call(vault, "Skill", name="vault:FireFly")) is not None
+    assert rule(call(vault, "Skill", kind="branch", skill="vault:firefly")) is None
+    assert rule(call(vault, "Skill", skill="общие:заметки")) is None
+    assert rule(call(vault, "Read", file_path="скиллы/vault/firefly/SKILL.md")) is None
+
+
 @pytest.fixture
 def home(vault: Path) -> Zones:
     """Зоны диспетчера с 2026-08-30: vault - дом, удаление - только своё."""