Initial commit: hardened DeerFlow factory

Vendored deer-flow upstream (bytedance/deer-flow) plus prompt-injection
hardening:

- New deerflow.security package: content_delimiter, html_cleaner,
  sanitizer (8 layers — invisible chars, control chars, symbols, NFC,
  PUA, tag chars, horizontal whitespace collapse with newline/tab
  preservation, length cap)
- New deerflow.community.searx package: web_search, web_fetch,
  image_search backed by a private SearX instance, every external
  string sanitized and wrapped in <<<EXTERNAL_UNTRUSTED_CONTENT>>>
  delimiters
- All native community web providers (ddg_search, tavily, exa,
  firecrawl, jina_ai, infoquest, image_search) replaced with hard-fail
  stubs that raise NativeWebToolDisabledError at import time, so a
  misconfigured tool.use path fails loud rather than silently falling
  back to unsanitized output
- Native client back-doors (jina_client.py, infoquest_client.py)
  stubbed too
- Native-tool tests quarantined under tests/_disabled_native/
  (collect_ignore_glob via local conftest.py)
- Sanitizer Layer 7 fix: only collapse horizontal whitespace, preserve
  newlines and tabs so list/table structure survives
- Hardened runtime config.yaml references only the searx-backed tools
- Factory overlay (backend/) kept in sync with deer-flow tree as a
  reference / source

See HARDENING.md for the full audit trail and verification steps.

deer-flow/backend/tests/test_skills_loader.py

@@ -0,0 +1,76 @@
+"""Tests for recursive skills loading."""
+
+from pathlib import Path
+
+from deerflow.skills.loader import get_skills_root_path, load_skills
+
+
+def _write_skill(skill_dir: Path, name: str, description: str) -> None:
+    """Write a minimal SKILL.md for tests."""
+    skill_dir.mkdir(parents=True, exist_ok=True)
+    content = f"---\nname: {name}\ndescription: {description}\n---\n\n# {name}\n"
+    (skill_dir / "SKILL.md").write_text(content, encoding="utf-8")
+
+
+def test_get_skills_root_path_points_to_project_root_skills():
+    """get_skills_root_path() should point to deer-flow/skills (sibling of backend/), not backend/packages/skills."""
+    path = get_skills_root_path()
+    assert path.name == "skills", f"Expected 'skills', got '{path.name}'"
+    assert (path.parent / "backend").is_dir(), f"Expected skills path's parent to be project root containing 'backend/', but got {path}"
+
+
+def test_load_skills_discovers_nested_skills_and_sets_container_paths(tmp_path: Path):
+    """Nested skills should be discovered recursively with correct container paths."""
+    skills_root = tmp_path / "skills"
+
+    _write_skill(skills_root / "public" / "root-skill", "root-skill", "Root skill")
+    _write_skill(skills_root / "public" / "parent" / "child-skill", "child-skill", "Child skill")
+    _write_skill(skills_root / "custom" / "team" / "helper", "team-helper", "Team helper")
+
+    skills = load_skills(skills_path=skills_root, use_config=False, enabled_only=False)
+    by_name = {skill.name: skill for skill in skills}
+
+    assert {"root-skill", "child-skill", "team-helper"} <= set(by_name)
+
+    root_skill = by_name["root-skill"]
+    child_skill = by_name["child-skill"]
+    team_skill = by_name["team-helper"]
+
+    assert root_skill.skill_path == "root-skill"
+    assert root_skill.get_container_file_path() == "/mnt/skills/public/root-skill/SKILL.md"
+
+    assert child_skill.skill_path == "parent/child-skill"
+    assert child_skill.get_container_file_path() == "/mnt/skills/public/parent/child-skill/SKILL.md"
+
+    assert team_skill.skill_path == "team/helper"
+    assert team_skill.get_container_file_path() == "/mnt/skills/custom/team/helper/SKILL.md"
+
+
+def test_load_skills_skips_hidden_directories(tmp_path: Path):
+    """Hidden directories should be excluded from recursive discovery."""
+    skills_root = tmp_path / "skills"
+
+    _write_skill(skills_root / "public" / "visible" / "ok-skill", "ok-skill", "Visible skill")
+    _write_skill(
+        skills_root / "public" / "visible" / ".hidden" / "secret-skill",
+        "secret-skill",
+        "Hidden skill",
+    )
+
+    skills = load_skills(skills_path=skills_root, use_config=False, enabled_only=False)
+    names = {skill.name for skill in skills}
+
+    assert "ok-skill" in names
+    assert "secret-skill" not in names
+
+
+def test_load_skills_prefers_custom_over_public_with_same_name(tmp_path: Path):
+    skills_root = tmp_path / "skills"
+    _write_skill(skills_root / "public" / "shared-skill", "shared-skill", "Public version")
+    _write_skill(skills_root / "custom" / "shared-skill", "shared-skill", "Custom version")
+
+    skills = load_skills(skills_path=skills_root, use_config=False, enabled_only=False)
+    shared = next(skill for skill in skills if skill.name == "shared-skill")
+
+    assert shared.category == "custom"
+    assert shared.description == "Custom version"