[KillerQueen-Z]

Recursive Glob searches use synchronous filesystem operations in the same process that serves Desktop management RPC. A slow workspace scan can therefore prevent skills.list from responding and leave the Skills panel in a loading/timeout state.

Make directory traversal, file metadata and credential-path checks asynchronous, yield during large flat scans, and honor cancellation. Preserve matching, excluded directories, symlink-loop protection, sensitive-path filtering, result limits and newest-first ordering. The existing synchronous path guards remain available to other tools.

Validation:

• Added a real authenticated WebSocket/server regression using isolated local filesystem fixtures. The beta.6 implementation reproduces Request skills.list timed out; the fix responds while slow directory and matching-file scans are still active, supports cancellation, and preserves the installed skill file.
• Checks credential symlink exclusions, recursive matching, loop handling and the 200-result limit. Wired the regression into core tests and macOS/Windows Desktop CI.
• Full local core suite: 928/928 passed. Desktop unit suite: 96/96 passed; Desktop typecheck and lint passed.
• No external service or paid model call is needed for this reproduction. It validates the blocking mechanism visible in the report; customer-machine logs would still be needed to establish the precise filesystem trigger.

Targets the published Desktop beta.6 release branch so unrelated release work is excluded. No installer release or updater rollout is part of this PR.