feat(config): `mcp.publish_skills: true|false`

[plind-junior]

What you're trying to do

kb.list_skills (just shipped) returns every visible slash command + SKILL.md to any MCP caller. gbrain's mcp.publish_skills config flag gates this — useful for a "company brain" where the catalogue itself is sensitive. Add the same flag in vouch's config.yaml; default true (current behaviour) so existing KBs don't break.

Suggested shape

mcp:
  publish_skills: true   # default; flip to false for company-brain mode

• kb.list_skills returns an empty list when publish_skills: false.
• kb.get_skill returns permission_denied when the flag is off.
• The flag is surfaced in kb.capabilities so clients can detect the gate.

Acceptance

• Flipping the flag instantly hides the catalogue without restarting the server.
• An existing KB with no mcp: block sees the catalogue (default-on).

Out of scope

• Per-skill visibility flags (all-or-nothing in v1).