feat: P0 KernelClient功能修复 + P1/P2/P3质量改进

P0 KernelClient 功能断裂修复:
- Skill CUD: registry.rs create/update/delete + serialize_skill_md + kernel proxy
- Workflow CUD: pipeline_commands.rs create/update/delete + serde_yaml依赖
- Agent更新: registry update方法 + AgentConfigUpdated事件 + agent_update命令
- Hand流式事件: HandStart/HandEnd变体替换ToolStart/ToolEnd
- 后端验证: hand_get/hand_run_status/hand_run_list确认实现完整
- Approval闭环: respond_to_approval后台spawn+5分钟超时轮询

P2/P3 质量改进:
- Browser WebDriver: TCP探测ChromeDriver/GeckoDriver/Edge端口替换硬编码true
- api-fallbacks: 移除假技能和16个捏造安全层，替换为真实能力映射
- dead_code清理: 移除5个模块级#![allow(dead_code)]，删除3个真正死方法，
  删除未注册的compactor_compact_llm命令，warnings从8降到3
- 所有变更通过cargo check + tsc --noEmit验证

desktop/src/lib/kernel-client.ts

@@ -107,11 +107,25 @@ export interface StreamEventError {
   message: string;
 }
 
+export interface StreamEventHandStart {
+  type: 'handStart';
+  name: string;
+  params: unknown;
+}
+
+export interface StreamEventHandEnd {
+  type: 'handEnd';
+  name: string;
+  result: unknown;
+}
+
 export type StreamChatEvent =
   | StreamEventDelta
   | StreamEventToolStart
   | StreamEventToolEnd
   | StreamEventIterationStart
+  | StreamEventHandStart
+  | StreamEventHandEnd
   | StreamEventComplete
   | StreamEventError;
 
@@ -415,10 +429,33 @@ export class KernelClient {
   }
 
   /**
-   * Update clone — not supported in KernelClient mode
+   * Update clone — maps to kernel agent_update
    */
-  async updateClone(_id: string, _updates: Record<string, unknown>): Promise<{ clone: unknown }> {
-    throw new Error('Agent update is not supported in local kernel mode');
+  async updateClone(id: string, updates: Record<string, unknown>): Promise<{ clone: unknown }> {
+    await invoke('agent_update', {
+      agentId: id,
+      updates: {
+        name: updates.name as string | undefined,
+        description: updates.description as string | undefined,
+        systemPrompt: updates.systemPrompt as string | undefined,
+        model: updates.model as string | undefined,
+        provider: updates.provider as string | undefined,
+        maxTokens: updates.maxTokens as number | undefined,
+        temperature: updates.temperature as number | undefined,
+      },
+    });
+
+    // Return updated clone representation
+    const clone = {
+      id,
+      name: updates.name,
+      role: updates.description || updates.role,
+      model: updates.model,
+      personality: updates.personality,
+      communicationStyle: updates.communicationStyle,
+      systemPrompt: updates.systemPrompt,
+    };
+    return { clone };
   }
 
   // === Chat ===
@@ -514,6 +551,20 @@ export class KernelClient {
             }
             break;
 
+          case 'handStart':
+            log.debug('Hand started:', streamEvent.name, streamEvent.params);
+            if (callbacks.onHand) {
+              callbacks.onHand(streamEvent.name, 'running', undefined);
+            }
+            break;
+
+          case 'handEnd':
+            log.debug('Hand ended:', streamEvent.name, streamEvent.result);
+            if (callbacks.onHand) {
+              callbacks.onHand(streamEvent.name, 'completed', streamEvent.result);
+            }
+            break;
+
           case 'iteration_start':
             log.debug('Iteration started:', streamEvent.iteration, '/', streamEvent.maxIterations);
             // Don't need to notify user about iterations
@@ -676,7 +727,7 @@ export class KernelClient {
     try {
       return await invoke('hand_get', { name });
     } catch {
-      // hand_get not yet implemented in backend
+      // Hand not found or kernel not initialized
       return {};
     }
   }
@@ -735,7 +786,7 @@ export class KernelClient {
       error?: string;
     }[]
   }> {
-    // Hand run history API may not exist yet, return empty array
+    // Hand run history
     try {
       return await invoke('hand_run_list', { handName: name, ...opts });
     } catch {
@@ -810,10 +861,102 @@ export class KernelClient {
   }
 
   /**
-   * Execute a skill
-   * Checks autonomy authorization before execution and passes the autonomy
-   * level to the backend for defense-in-depth enforcement.
+   * Create a new skill
    */
+  async createSkill(skill: {
+    name: string;
+    description?: string;
+    triggers: Array<{ type: string; pattern?: string }>;
+    actions: Array<{ type: string; params?: Record<string, unknown> }>;
+    enabled?: boolean;
+  }): Promise<{ skill?: {
+    id: string;
+    name: string;
+    description: string;
+    version: string;
+    capabilities: string[];
+    tags: string[];
+    mode: string;
+    enabled: boolean;
+    triggers: string[];
+    category?: string;
+  } }> {
+    const result = await invoke<{
+      id: string;
+      name: string;
+      description: string;
+      version: string;
+      capabilities: string[];
+      tags: string[];
+      mode: string;
+      enabled: boolean;
+      triggers: string[];
+      category?: string;
+    }>('skill_create', {
+      request: {
+        name: skill.name,
+        description: skill.description,
+        triggers: skill.triggers.map(t => t.pattern || t.type),
+        actions: skill.actions.map(a => a.type),
+        enabled: skill.enabled,
+      },
+    });
+    return { skill: result };
+  }
+
+  /**
+   * Update an existing skill
+   */
+  async updateSkill(id: string, updates: {
+    name?: string;
+    description?: string;
+    triggers?: Array<{ type: string; pattern?: string }>;
+    actions?: Array<{ type: string; params?: Record<string, unknown> }>;
+    enabled?: boolean;
+  }): Promise<{ skill?: {
+    id: string;
+    name: string;
+    description: string;
+    version: string;
+    capabilities: string[];
+    tags: string[];
+    mode: string;
+    enabled: boolean;
+    triggers: string[];
+    category?: string;
+  } }> {
+    const result = await invoke<{
+      id: string;
+      name: string;
+      description: string;
+      version: string;
+      capabilities: string[];
+      tags: string[];
+      mode: string;
+      enabled: boolean;
+      triggers: string[];
+      category?: string;
+    }>('skill_update', {
+      id,
+      request: {
+        name: updates.name,
+        description: updates.description,
+        triggers: updates.triggers?.map(t => t.pattern || t.type),
+        actions: updates.actions?.map(a => a.type),
+        enabled: updates.enabled,
+      },
+    });
+    return { skill: result };
+  }
+
+  /**
+   * Delete a skill
+   */
+  async deleteSkill(id: string): Promise<void> {
+    await invoke('skill_delete', { id });
+  }
+
+  /**
   async executeSkill(id: string, input?: Record<string, unknown>): Promise<{
     success: boolean;
     output?: unknown;