fix(ui): route tasks.js + skills.js dropdowns through topPortalZ() (#4768)

Fixes #4767. #4724 routed 16 body-portaled dropdowns through the shared
topPortalZ() helper so they always render just above the currently-raised tool
modal, but two were missed and still used a hardcoded z-index, so they hit the
same #4720 bug once a modal's bring-to-front counter climbed past the literal:

  - tasks.js _showTaskDropdown(): inline z-index:100000 on .task-dropdown
  - skills.js kebab menu (.skill-kebab-menu): z-index:100002 in style.css

Both now set zIndex from topPortalZ() after they are appended to the body,
matching the other migrated sites. The dead CSS z-index on .skill-kebab-menu is
removed (the inline value always wins). test_portal_dropdown_z_js.py gains a
source guard asserting both files use topPortalZ() and that no hardcoded
100000/100002 portal literal survives in either file or style.css.

tests/test_portal_dropdown_z_js.py

@@ -9,6 +9,7 @@ and the dock-chip floor, without importing the browser-heavy UI modules.
 """
 
 import json
+import re
 import shutil
 import subprocess
 import textwrap
@@ -87,3 +88,22 @@ def test_portal_z_uses_chip_floor_when_the_open_modal_sits_below_it():
     )
 
     assert values == {"z": 10031}
+
+
+# tasks.js and skills.js were not in #4724's batch; #4767 routes their portaled
+# dropdowns through the same helper. Pin that they use topPortalZ() and carry no
+# hardcoded portal z-index, so they cannot regress to the #4720 bug.
+@pytest.mark.parametrize("rel", ["static/js/tasks.js", "static/js/skills.js"])
+def test_late_routed_dropdowns_use_top_portal_z(rel):
+    src = (ROOT / rel).read_text()
+    assert "topPortalZ" in src, f"{rel} must import/use topPortalZ()"
+    assert "topPortalZ()" in src, f"{rel} must call topPortalZ() for its dropdown z"
+
+
+@pytest.mark.parametrize("rel", ["static/js/tasks.js", "static/js/skills.js", "static/style.css"])
+def test_no_hardcoded_portal_z_literals_remain(rel):
+    src = (ROOT / rel).read_text()
+    # Match the exact 100000/100002 these dropdowns used; the trailing-digit
+    # guard avoids false-matching an unrelated 1000000 elsewhere.
+    hits = re.findall(r"z-index:\s*10000[02](?!\d)", src)
+    assert not hits, f"{rel} still has hardcoded portal z: {hits}"