fix(skills): literal HOME replacement; ~/$VAR still expands the variable

`re.sub` with the home path as a template string parsed backslashes as
escapes (re.error dropped the whole injected config block); use a callable.
The early `~/…` return also skipped `expandvars`, leaving `~/$LEAF` half
resolved. Prefix-substitute and fall through to normal expansion instead.

agent/skill_utils.py

@@ -715,11 +715,11 @@ def _expand_skill_config_path(value: str) -> str:
     """
     subprocess_home = get_subprocess_home()
     if subprocess_home:
-        if value == "~":
-            return subprocess_home
-        if value.startswith(("~/", "~\\")):
-            return os.path.join(subprocess_home, value[2:])
-        value = _HOME_VAR_RE.sub(subprocess_home, value)
+        if value == "~" or value.startswith(("~/", "~\\")):
+            value = subprocess_home + value[1:]
+        # Callable replacement: a literal template would parse backslashes in the home path
+        # as regex escapes.
+        value = _HOME_VAR_RE.sub(lambda _m: subprocess_home, value)
     return os.path.expanduser(os.path.expandvars(value))