fix(audit): Batch 2 生产代码 unwrap 替换 (20 处)

P0 修复:
- viking_commands.rs: URI 路径构建 unwrap → ok_or_else 错误传播
- clip.rs: 临时文件路径 unwrap → ok_or_else (防 Windows 中文路径 panic)

P1 修复:
- personality_detector.rs: Mutex lock unwrap → unwrap_or_else 防中毒传播
- pptx.rs: HashMap.get unwrap → expect (来自 keys() 迭代)

P2 修复:
- 4 处 SystemTime.unwrap → expect("system clock is valid")
- 4 处 dev_server URL.parse.unwrap → expect("hardcoded URL is valid")
- 9 处 nl_schedule Regex.unwrap → expect("static regex is valid")
- 5 处 data_masking Regex.unwrap → expect("static regex is valid")
- 2 处 pipeline/state Regex.unwrap → expect("static regex is valid")

全量测试通过: 719 passed, 0 failed

desktop/src-tauri/src/classroom_commands/generate.rs

@@ -207,7 +207,7 @@ pub async fn classroom_generate(
         metadata: zclaw_kernel::generation::ClassroomMetadata {
             generated_at: std::time::SystemTime::now()
                 .duration_since(std::time::UNIX_EPOCH)
-                .unwrap()
+                .expect("system clock is valid")
                 .as_millis() as i64,
             source_document: kernel_request.document.map(|_| "user_document".to_string()),
             model: None,

desktop/src-tauri/src/dev_server.rs

@@ -48,10 +48,10 @@ async fn run_server(state: DevServerState) {
         .layer(
             CorsLayer::new()
                 .allow_origin([
-                    "http://localhost:1420".parse().unwrap(),
-                    "http://127.0.0.1:1420".parse().unwrap(),
-                    "http://localhost:5173".parse().unwrap(),
-                    "http://127.0.0.1:5173".parse().unwrap(),
+                    "http://localhost:1420".parse().expect("hardcoded localhost URL is valid"),
+                    "http://127.0.0.1:1420".parse().expect("hardcoded localhost URL is valid"),
+                    "http://localhost:5173".parse().expect("hardcoded localhost URL is valid"),
+                    "http://127.0.0.1:5173".parse().expect("hardcoded localhost URL is valid"),
                 ])
                 .allow_methods([Method::GET, Method::POST, Method::OPTIONS])
                 .allow_headers([header::CONTENT_TYPE, header::AUTHORIZATION]),

desktop/src-tauri/src/intelligence/personality_detector.rs

@@ -339,12 +339,12 @@ fn personality_store() -> &'static Mutex<std::collections::HashMap<String, Perso
 /// Load personality config for a given agent.
 /// Returns default config if none is stored.
 pub fn load_personality_config(agent_id: &str) -> PersonalityConfig {
-    let store = personality_store().lock().unwrap();
+    let store = personality_store().lock().unwrap_or_else(|e| e.into_inner());
     store.get(agent_id).cloned().unwrap_or_default()
 }
 
 /// Save personality config for a given agent.
 pub fn save_personality_config(agent_id: &str, config: &PersonalityConfig) {
-    let mut store = personality_store().lock().unwrap();
+    let mut store = personality_store().lock().unwrap_or_else(|e| e.into_inner());
     store.insert(agent_id.to_string(), config.clone());
 }

desktop/src-tauri/src/viking_commands.rs

@@ -489,7 +489,7 @@ pub async fn viking_tree(path: String, depth: Option<usize>) -> Result<serde_jso
             current = current
                 .get_mut(*part)
                 .and_then(|v| v.as_object_mut())
-                .unwrap();
+                .ok_or_else(|| format!("Invalid URI tree structure at segment: {}", part))?;
         }
 
         if let Some(last) = parts.last() {