feat: P0 KernelClient功能修复 + P1/P2/P3质量改进

P0 KernelClient 功能断裂修复:
- Skill CUD: registry.rs create/update/delete + serialize_skill_md + kernel proxy
- Workflow CUD: pipeline_commands.rs create/update/delete + serde_yaml依赖
- Agent更新: registry update方法 + AgentConfigUpdated事件 + agent_update命令
- Hand流式事件: HandStart/HandEnd变体替换ToolStart/ToolEnd
- 后端验证: hand_get/hand_run_status/hand_run_list确认实现完整
- Approval闭环: respond_to_approval后台spawn+5分钟超时轮询

P2/P3 质量改进:
- Browser WebDriver: TCP探测ChromeDriver/GeckoDriver/Edge端口替换硬编码true
- api-fallbacks: 移除假技能和16个捏造安全层，替换为真实能力映射
- dead_code清理: 移除5个模块级#![allow(dead_code)]，删除3个真正死方法，
  删除未注册的compactor_compact_llm命令，warnings从8降到3
- 所有变更通过cargo check + tsc --noEmit验证

desktop/src/store/configStore.ts

@@ -667,14 +667,60 @@ function createConfigClientFromKernel(client: KernelClient): ConfigStoreClient {
     getSkill: async (id: string) => {
       return { skill: { id, name: id, description: '' } };
     },
-    createSkill: async () => {
-      throw new Error('Skill creation not supported in KernelClient');
+    createSkill: async (skill) => {
+      try {
+        const result = await client.createSkill(skill);
+        if (result?.skill) {
+          return {
+            skill: {
+              id: result.skill.id,
+              name: result.skill.name,
+              description: result.skill.description,
+              version: result.skill.version,
+              capabilities: result.skill.capabilities,
+              tags: result.skill.tags,
+              mode: result.skill.mode,
+              enabled: result.skill.enabled,
+              triggers: (result.skill.triggers || []).map((t: string) => ({ type: 'keyword', pattern: t })),
+              category: result.skill.category,
+            } as SkillInfo,
+          };
+        }
+        return null;
+      } catch {
+        return null;
+      }
     },
-    updateSkill: async () => {
-      throw new Error('Skill update not supported in KernelClient');
+    updateSkill: async (id, updates) => {
+      try {
+        const result = await client.updateSkill(id, updates);
+        if (result?.skill) {
+          return {
+            skill: {
+              id: result.skill.id,
+              name: result.skill.name,
+              description: result.skill.description,
+              version: result.skill.version,
+              capabilities: result.skill.capabilities,
+              tags: result.skill.tags,
+              mode: result.skill.mode,
+              enabled: result.skill.enabled,
+              triggers: (result.skill.triggers || []).map((t: string) => ({ type: 'keyword', pattern: t })),
+              category: result.skill.category,
+            } as SkillInfo,
+          };
+        }
+        return null;
+      } catch {
+        return null;
+      }
     },
-    deleteSkill: async () => {
-      throw new Error('Skill deletion not supported in KernelClient');
+    deleteSkill: async (id) => {
+      try {
+        await client.deleteSkill(id);
+      } catch {
+        // Ignore deletion errors
+      }
     },
     listChannels: async () => ({ channels: [] }),
     getChannel: async () => null,