feat: P0 KernelClient功能修复 + P1/P2/P3质量改进

P0 KernelClient 功能断裂修复:
- Skill CUD: registry.rs create/update/delete + serialize_skill_md + kernel proxy
- Workflow CUD: pipeline_commands.rs create/update/delete + serde_yaml依赖
- Agent更新: registry update方法 + AgentConfigUpdated事件 + agent_update命令
- Hand流式事件: HandStart/HandEnd变体替换ToolStart/ToolEnd
- 后端验证: hand_get/hand_run_status/hand_run_list确认实现完整
- Approval闭环: respond_to_approval后台spawn+5分钟超时轮询

P2/P3 质量改进:
- Browser WebDriver: TCP探测ChromeDriver/GeckoDriver/Edge端口替换硬编码true
- api-fallbacks: 移除假技能和16个捏造安全层，替换为真实能力映射
- dead_code清理: 移除5个模块级#![allow(dead_code)]，删除3个真正死方法，
  删除未注册的compactor_compact_llm命令，warnings从8降到3
- 所有变更通过cargo check + tsc --noEmit验证

crates/zclaw-kernel/src/kernel.rs

@@ -480,6 +480,35 @@ impl Kernel {
         Ok(())
     }
 
+    /// Update an existing agent's configuration
+    pub async fn update_agent(&self, config: AgentConfig) -> Result<()> {
+        let id = config.id;
+
+        // Validate the agent exists
+        if self.registry.get(&id).is_none() {
+            return Err(zclaw_types::ZclawError::NotFound(
+                format!("Agent not found: {}", id)
+            ));
+        }
+
+        // Validate capabilities
+        self.capabilities.validate(&config.capabilities)?;
+
+        // Save updated config to memory
+        self.memory.save_agent(&config).await?;
+
+        // Update in registry (preserves state and message count)
+        self.registry.update(config.clone());
+
+        // Emit event
+        self.events.publish(Event::AgentConfigUpdated {
+            agent_id: id,
+            name: config.name.clone(),
+        });
+
+        Ok(())
+    }
+
     /// List all agents
     pub fn list_agents(&self) -> Vec<AgentInfo> {
         self.registry.list()
@@ -710,6 +739,42 @@ impl Kernel {
         Ok(())
     }
 
+    /// Get the configured skills directory
+    pub fn skills_dir(&self) -> Option<&std::path::PathBuf> {
+        self.config.skills_dir.as_ref()
+    }
+
+    /// Create a new skill in the skills directory
+    pub async fn create_skill(&self, manifest: zclaw_skills::SkillManifest) -> Result<()> {
+        let skills_dir = self.config.skills_dir.as_ref()
+            .ok_or_else(|| zclaw_types::ZclawError::InvalidInput(
+                "Skills directory not configured".into()
+            ))?;
+        self.skills.create_skill(skills_dir, manifest).await
+    }
+
+    /// Update an existing skill
+    pub async fn update_skill(
+        &self,
+        id: &zclaw_types::SkillId,
+        manifest: zclaw_skills::SkillManifest,
+    ) -> Result<zclaw_skills::SkillManifest> {
+        let skills_dir = self.config.skills_dir.as_ref()
+            .ok_or_else(|| zclaw_types::ZclawError::InvalidInput(
+                "Skills directory not configured".into()
+            ))?;
+        self.skills.update_skill(skills_dir, id, manifest).await
+    }
+
+    /// Delete a skill
+    pub async fn delete_skill(&self, id: &zclaw_types::SkillId) -> Result<()> {
+        let skills_dir = self.config.skills_dir.as_ref()
+            .ok_or_else(|| zclaw_types::ZclawError::InvalidInput(
+                "Skills directory not configured".into()
+            ))?;
+        self.skills.delete_skill(skills_dir, id).await
+    }
+
     /// Execute a skill with the given ID and input
     pub async fn execute_skill(
         &self,