feat: P0 KernelClient功能修复 + P1/P2/P3质量改进

P0 KernelClient 功能断裂修复:
- Skill CUD: registry.rs create/update/delete + serialize_skill_md + kernel proxy
- Workflow CUD: pipeline_commands.rs create/update/delete + serde_yaml依赖
- Agent更新: registry update方法 + AgentConfigUpdated事件 + agent_update命令
- Hand流式事件: HandStart/HandEnd变体替换ToolStart/ToolEnd
- 后端验证: hand_get/hand_run_status/hand_run_list确认实现完整
- Approval闭环: respond_to_approval后台spawn+5分钟超时轮询

P2/P3 质量改进:
- Browser WebDriver: TCP探测ChromeDriver/GeckoDriver/Edge端口替换硬编码true
- api-fallbacks: 移除假技能和16个捏造安全层，替换为真实能力映射
- dead_code清理: 移除5个模块级#![allow(dead_code)]，删除3个真正死方法，
  删除未注册的compactor_compact_llm命令，warnings从8降到3
- 所有变更通过cargo check + tsc --noEmit验证

crates/zclaw-hands/src/hands/browser.rs

@@ -157,11 +157,22 @@ impl BrowserHand {
         }
     }
 
-    /// Check if WebDriver is available
+    /// Check if WebDriver is available by probing common ports
     fn check_webdriver(&self) -> bool {
-        // Check if ChromeDriver or GeckoDriver is running
-        // For now, return true as the actual check would require network access
-        true
+        use std::net::TcpStream;
+        use std::time::Duration;
+
+        // Probe default WebDriver ports: ChromeDriver (9515), GeckoDriver (4444), Edge (17556)
+        let ports = [9515, 4444, 17556];
+        for port in ports {
+            let addr = format!("127.0.0.1:{}", port);
+            if let Ok(addr) = addr.parse() {
+                if TcpStream::connect_timeout(&addr, Duration::from_millis(500)).is_ok() {
+                    return true;
+                }
+            }
+        }
+        false
     }
 }