feat(harness): load skills directly from TOS sources

[Rhosmarie]

Summary

Enable Harness to load Skills directly from TOS without registering them in Skill Space first.

Each TOS source represents exactly one Skill. Multiple Skills are supplied through multiple selected_skills entries.

Changes

• Add source="tos" support to HarnessSelectedSkill.
• Support private TOS Skill directories through tos_url.
• Support public TOS ZIP archives through tos_public_url.
• Use the Harness runtime cloud identity for private TOS access.
• Require SKILL.md or skill.md at the root of private TOS directories.
• Reuse the existing ADK load_skill_from_dir and SkillToolset flow.
• Preserve existing SkillHub and Skill Space behavior.
• Add bilingual PRD documentation and focused test coverage.

Example

selected_skills = [
    HarnessSelectedSkill(
        source="tos",
        tos_url="tos://bucket/skills/reporting/",
        region="cn-beijing",
    ),
    HarnessSelectedSkill(
        source="tos",
        tos_public_url=(
            "https://bucket.tos-cn-beijing.volces.com/skills/search.zip"
        ),
        region="cn-beijing",
    ),
]