fix(config): accept any string in disabled_skills and disabled_commands (#53)

* fix(config): accept any string in disabled_skills and disabled_commands

Before: disabled_skills required one of 7 hardcoded builtin names;
disabled_commands required one of 9 hardcoded builtin names. Users with
150+ community/user-installed skills could not disable any of them
because the Zod schema rejected unknown names at parse time.

After: both fields accept any non-empty string. Unknown names are a
silent no-op at the loader layer, which already handles arbitrary
skill/command names via Set lookups. The downstream
loadBuiltinCommands() signature widens from BuiltinCommandName[] to
readonly string[] so the inferred config type flows through cleanly.

The type widening is strictly permissive: every value that parsed
before still parses after, so existing configs with
disabled_skills: ['review-work'] continue to work unchanged.

* test(config): cover user-installed names in disabled_skills and disabled_commands

Adds four cases across the two widened fields:

- disabled_skills accepts non-builtin skill names like qs-anti-patterns
  and names containing slashes like frontend/nextjs
- disabled_commands accepts user-defined command names
- both fields still reject empty strings (z.string().min(1))

Keeps the original review-work / ai-slop-remover regression test so we
catch accidental re-narrowing of the schema.