YOLO suppresses trust prompt but still blocks .codex/skills (empty $ menu without explanation)

Summary

In YOLO mode ("--dangerously-bypass-approvals-and-sandbox" / "--yolo"), Codex suppresses the trust onboarding prompt, but repo-scoped .codex/skills are still gated on per-project trust. This can produce an empty $ skills mention menu with no explanation.

This is a UX papercut: YOLO already implies the user is taking responsibility for safety, but the UI gives no signal that repo-local skills are intentionally not loaded because the project is untrusted.

Repro

1. In a git repo (so project root detection finds .git), create a skill under <repo>/.codex/skills/<name>/SKILL.md with valid frontmatter.
2. Ensure the repo has no trust decision (no trust_level entry for the repo/cwd in ~/.codex/config.toml).
3. Run Codex TUI in YOLO mode: codex --yolo.
4. In the composer, type $.

Actual

• No trust prompt shown.
• Repo-scoped skills under .codex/skills do not appear in the $ menu (likely because the project is untrusted and project layers are not loaded).
• No UI message explains why skills are missing.

Expected

One of:

• (A) The UI should surface an explicit message/banner in YOLO mode (or generally) when repo-local .codex/skills are skipped due to untrusted project.
• (B) Provide an explicit UX affordance to trust the current project (even if YOLO suppresses onboarding) so repo-local skills can be loaded.
• (C) If YOLO is intended to imply trust for config/skills loading, document that and/or automatically treat the current project as trusted for the purpose of loading .codex/ layers (security implications should be considered).

Implementation notes

• YOLO sets sandbox_mode = DangerFullAccess and approval_policy = Never: codex-rs/tui/src/lib.rs.
• Trust onboarding is suppressed when config.did_user_set_custom_approval_policy_or_sandbox_mode is true: codex-rs/tui/src/lib.rs:should_show_trust_screen.
• Project layers (and thus .codex/skills) are only loaded when projects.<path>.trust_level == trusted: codex-rs/core/src/config_loader/mod.rs:trusted_project_root.
• Skills roots come from config layer folders + /skills: codex-rs/core/src/skills/loader.rs:skill_roots_from_layer_stack_inner.

Version

• git HEAD: a4cb97ba5a6d02cb066dfda73e7ea83823a55fea