fix(kimaki): allowlist managed skills

[chubes4]

Summary

• Replace the managed Kimaki skill blacklist with an allowlist that only enables upgrade-wp-coding-agents.
• Render managed systemd and launchd services with --enable-skill upgrade-wp-coding-agents, keeping unrelated Kimaki bundled skills hidden by default.
• Preserve legacy disable-list fallback handling for older installed configs until the new allowlist is synced.

Testing

• tests/bridge-render.sh
• tests/post-upgrade-restore.sh
• bash -n bridges/kimaki.sh upgrade.sh
• git diff --check origin/main...HEAD

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Investigated the Kimaki skill leak, split the allowlist follow-up from the already-merged critique blacklist PR, drafted the durable wp-coding-agents service-template allowlist change, and ran targeted verification. Chris identified the requirement and remains responsible for review.