fix(harness): stop orphan GC from deleting skills other calls still use

Fixes #2787

MarketplaceStager rebuilt its retain-list from a single call's visible
skills and then deleted every other directory under a `.skills-cache` tree
shared by every call against the workspace. With per-user skill visibility,
call B's "orphan" was call A's live filesRoot, so B removed a directory A
had just staged - often while A was still walking it, which surfaced as an
UncheckedIOException out of onSystemPrompt that failed the whole agent call
before its first model round.

Two changes, matching the two defects in the issue.

Traversal no longer aborts on a vanished entry. deleteRecursively uses
Files.walkFileTree, so an entry removed mid-walk is reported through
visitFileFailed instead of ending the traversal; removeUnexpected and
garbageCollectOrphans also catch UncheckedIOException, which Files.walk and
Files.list throw for mid-iteration IO errors and which is not an IOException;
and the GC call is wrapped so cache hygiene can never fail an agent call,
mirroring the fallback already applied per skill.

Staging is scoped, following the issue's own suggestion to prefix
`.skills-cache` with the namespace IsolationScope already applies to runtime
data. Skills now materialise under `.skills-cache/<scope>/<source-ns>/<name>/`,
where the scope is the call's userId (or sessionId, matching
IsolationScope.USER's documented fallback). Calls that do not share a scope
cannot address each other's subtree, so a white-list built from one call's
visible skills is authoritative for everything its sweep can reach - the
property the flat layout never had. A short grace window remains as a backstop
for entries whose visibility changes within a scope.

The scope must be at least as fine as the visibility dimension. The default,
USER, matches the per-user visibility filters this failure was reported
against; an agent that combines AGENT or GLOBAL scope with per-user visibility
still shares one subtree and relies on the grace window alone.

Tests:

- MarketplaceStagerOrphanGcTest keeps a fresh orphan, still reclaims a stale
  one, survives concurrent callers with differing visible sets, degrades
  rather than throwing on an unreadable entry, and asserts that an aged
  directory in one scope is unreachable by another scope's sweep.
- SharedWorkspaceSkillStagingE2ETest drives the real middleware path: two
  agents sharing one workspace, per-user visibility asserting that no prompt
  ever advertises a files-root missing from disk, and a deterministic case
  where one user's call must not delete another user's staged skill.

Each of those fails against the unpatched stager. Full suite: 89/89 modules,
5983 tests, 0 failures.

Author: wangchenxuya

agentscope-harness/src/main/java/io/agentscope/harness/agent/HarnessAgent.java

@@ -2775,6 +2775,7 @@ public HarnessAgent build() {
                                         visibilityFilter,
                                         stager,
                                         shellPolicy);
+                skillMiddleware.isolationScope(fsIsolationScope);
                 inner.middleware(skillMiddleware);
 
                 // Harness owns both the live and frozen repository paths.

agentscope-harness/src/main/java/io/agentscope/harness/agent/middleware/HarnessSkillMiddleware.java

@@ -21,6 +21,7 @@
 import io.agentscope.core.skill.SkillFilter;
 import io.agentscope.core.skill.repository.AgentSkillRepository;
 import io.agentscope.core.tool.Toolkit;
+import io.agentscope.harness.agent.IsolationScope;
 import io.agentscope.harness.agent.skill.LazyResourceCapable;
 import io.agentscope.harness.agent.skill.RuntimeContextSkillRepository;
 import io.agentscope.harness.agent.skill.SkillResources;
@@ -81,6 +82,34 @@ public class HarnessSkillMiddleware implements HarnessRuntimeMiddleware {
     private final SkillRuntime runtime;
     private final Map<AgentSkillRepository, String> sourceNamespaces;
     private final Map<String, RepoBound> frozenSkills;
+    private IsolationScope isolationScope;
+
+    /**
+     * Per-call cache scope, mirroring the identity {@link IsolationScope} already applies to
+     * runtime data. Calls that share a scope share a {@code .skills-cache} subtree, and only
+     * those calls can sweep it — which is what makes one call's visible-skill white-list
+     * authoritative for everything the sweep can reach.
+     */
+    private String scopeKeyFor(RuntimeContext ctx) {
+        IsolationScope scope = isolationScope != null ? isolationScope : IsolationScope.USER;
+        return switch (scope) {
+            case USER -> {
+                String uid = ctx != null ? ctx.getUserId() : null;
+                if (uid != null && !uid.isBlank()) {
+                    yield uid;
+                }
+                // Mirrors IsolationScope.USER's documented fall back to the session identity.
+                String sid = ctx != null ? ctx.getSessionId() : null;
+                yield sid != null ? sid : MarketplaceStager.SHARED_SCOPE;
+            }
+            case SESSION -> {
+                String sid = ctx != null ? ctx.getSessionId() : null;
+                yield sid != null && !sid.isBlank() ? sid : MarketplaceStager.SHARED_SCOPE;
+            }
+            // The workspace is already per-agent, so these need no further separation.
+            case AGENT, GLOBAL -> MarketplaceStager.SHARED_SCOPE;
+        };
+    }
 
     public HarnessSkillMiddleware(List<AgentSkillRepository> repositories, Toolkit toolkit) {
         this(repositories, toolkit, null, null, null, ShellPathPolicy.noShell());
@@ -169,6 +198,7 @@ private HarnessSkillMiddleware(
         this.stager = stager;
         this.shellPathPolicy =
                 shellPathPolicy != null ? shellPathPolicy : ShellPathPolicy.noShell();
+        this.isolationScope = IsolationScope.USER;
         this.runtime = new SkillRuntime();
         // Pre-resolve source namespaces once at build time. The compose order is fixed for
         // the lifetime of the middleware, so this is safe and avoids repeated work per call.
@@ -186,6 +216,15 @@ public SkillRuntime runtime() {
         return runtime;
     }
 
+    /**
+     * Overrides the isolation dimension used to separate {@code .skills-cache} subtrees.
+     * Defaults to {@link IsolationScope#USER}, matching the default for runtime data.
+     */
+    public HarnessSkillMiddleware isolationScope(IsolationScope scope) {
+        this.isolationScope = scope;
+        return this;
+    }
+
     /** Whether repository enumeration is frozen to the construction-time snapshot. */
     public boolean isFrozen() {
         return frozenSkills != null;
@@ -213,7 +252,7 @@ public void prestageMarketplaceSkills(RuntimeContext ctx) {
         List<RepoBound> visible = applyVisibility(merged.values(), ctx);
         List<RepoBound> enabled = applySkillFilter(visible, effectiveFilter(ctx));
         if (!enabled.isEmpty()) {
-            stager.stage(enabled, sourceNamespaces);
+            stager.stage(enabled, sourceNamespaces, scopeKeyFor(ctx));
         }
     }
 
@@ -239,7 +278,9 @@ public Mono<String> onSystemPrompt(Agent agent, RuntimeContext ctx, String curre
         }
 
         Map<String, StageResult> staged =
-                stager != null ? stager.stage(enabled, sourceNamespaces) : Map.of();
+                stager != null
+                        ? stager.stage(enabled, sourceNamespaces, scopeKeyFor(ctx))
+                        : Map.of();
 
         List<HarnessSkillEntry> entries = new ArrayList<>(enabled.size());
         for (RepoBound bound : enabled) {