Clean up partial skill extractions on failure

[sylvesterkaczmarek]

Summary

Make session-skill download and extraction transactional so failed or cancelled extraction cannot leave untracked third-party files in the agent workdir.

download_session_skills() returns the directories that AgentToolContext later removes during teardown. A skill directory is currently appended to that list only after _download_and_extract() succeeds.

If archive streaming or extraction creates part of the destination tree and then raises, the outer loop logs the failure and continues, but the partial directory was never added to the returned cleanup list. AgentToolContext._cleanup_skills() therefore never removes it.

The temporary .skill-*.archive file also uses an async unlink in finally without shielding, so cancellation can interrupt that cleanup.

Fix

Treat each skill extraction as transactional:

• if _download_and_extract() raises after the previous destination has been cleared, remove the destination tree before propagating the error;
• perform that removal under an AnyIO cancellation shield;
• re-raise cancellation rather than swallowing it in the normal per-skill error handler;
• shield removal of the temporary downloaded archive in _download_and_extract() as well.

Ordinary per-skill failures retain the existing behavior: they are logged and the downloader proceeds to the next skill, but no partial destination remains behind.

Regression coverage

Adds focused async tests verifying:

• a downloader that creates a partial destination and then fails leaves no skill directory behind and is not reported as successfully downloaded;
• a failed streaming download leaves no .skill-*.archive temporary file behind.

The production change is confined to Anthropic's hand-maintained skill download/extraction helper.