feat(cli): resolve skills credentials with the shared chain

What does this MR do and why?

orbit skills get only asked the instance for the deployed skill when glab had exported its Orbit variables, and otherwise printed the bundled skill silently. It now finds credentials like the other remote commands, so a plain GITLAB_TOKEN or a glab login is enough. With no credential it warns on stderr. A scheme-less instance URL now fails with a clear "must be an absolute https URL" message instead of a reqwest builder error.

Related Issues

Relates to #1063 (closed). Follow-up to the skills work in !2568 (merged).

Testing

cargo test -p orbit-cli, mise test:cli (50 tests) and mise lint:code pass. New integration tests cover GITLAB_TOKEN with GITLAB_URL, the glab credential helper, the warning, and a scheme-less GITLAB_URL for both skills and status. The tests clear the credential variables and run without glab on PATH, so none touch a real login.

Performance Analysis

No change to the request path. The glab credential helper now runs when no env credentials are set, once per process.

• This merge request does not introduce any performance regression. If a performance regression is expected, explain why.

Agent context: long-form analysis, file-by-file walkthroughs, profiler output, alternatives considered

• OrbitClient::from_skill_env now calls resolve_endpoint. Any resolution error becomes None, and skill.rs prints the stderr warning, so skills and skills get fall back to the bundled skill as before. Both callers in skill.rs are covered.
• GITLAB_URL stays the only host variable. GITLAB_HOST support would be a separate change for all remote commands.
• The old doc comment said partial glab tuples must not invoke the credential helper. I found no discussion in !2568 (merged) giving a reason, so I treated it as a default for offline use, which the warning plus fallback still preserves.
• resolve_endpoint validates GITLAB_URL, ORBIT_API_BASE_URL and the credential helper's instance_url once: the value must parse as an http(s) URL with a host. Failures carry the variable name, and the plaintext warning is decided on the parsed scheme, so it fires only for real http:// values. from_skill_env returns None only for a missing credential (a typed MissingCredential error); an invalid URL surfaces as the error, and skill_client prints it as a warning and falls back to the bundled skill. orbit query and the other remote commands fail with the same message.
• Integration tests, including the one in crates/integration-tests/tests/cli.rs, point PATH at a nonexistent directory and scrub GITLAB_* and ORBIT_* variables. The old test that asserted glab is never spawned is replaced by a helper-success test.
• Docs updated: docs/design-documents/querying/README.md and docs/dev/orbit-local-quickstart.md.
• mise lint:docs reports link errors for missing docs/source/* files that also fail without this change. Prose lint passes.