feat: P0 KernelClient功能修复 + P1/P2/P3质量改进

P0 KernelClient 功能断裂修复:
- Skill CUD: registry.rs create/update/delete + serialize_skill_md + kernel proxy
- Workflow CUD: pipeline_commands.rs create/update/delete + serde_yaml依赖
- Agent更新: registry update方法 + AgentConfigUpdated事件 + agent_update命令
- Hand流式事件: HandStart/HandEnd变体替换ToolStart/ToolEnd
- 后端验证: hand_get/hand_run_status/hand_run_list确认实现完整
- Approval闭环: respond_to_approval后台spawn+5分钟超时轮询

P2/P3 质量改进:
- Browser WebDriver: TCP探测ChromeDriver/GeckoDriver/Edge端口替换硬编码true
- api-fallbacks: 移除假技能和16个捏造安全层，替换为真实能力映射
- dead_code清理: 移除5个模块级#![allow(dead_code)]，删除3个真正死方法，
  删除未注册的compactor_compact_llm命令，warnings从8降到3
- 所有变更通过cargo check + tsc --noEmit验证

desktop/src/store/workflowStore.ts

@@ -413,14 +413,52 @@ function createWorkflowClientFromKernel(_client: KernelClient): WorkflowClient {
         return null;
       }
     },
-    createWorkflow: async () => {
-      throw new Error('Workflow creation not supported in KernelClient mode. Pipelines are file-based YAML definitions.');
+    createWorkflow: async (workflow) => {
+      try {
+        const result = await invoke<{ id: string; name: string }>('pipeline_create', {
+          request: {
+            name: workflow.name,
+            description: workflow.description,
+            steps: workflow.steps.map((s, i) => ({
+              handName: s.handName,
+              name: s.name || `Step ${i + 1}`,
+              params: s.params,
+              condition: s.condition,
+            })),
+          },
+        });
+        return result;
+      } catch {
+        return null;
+      }
     },
-    updateWorkflow: async () => {
-      throw new Error('Workflow update not supported in KernelClient mode. Pipelines are file-based YAML definitions.');
+    updateWorkflow: async (id, updates) => {
+      try {
+        const result = await invoke<{ id: string; name: string }>('pipeline_update', {
+          pipelineId: id,
+          request: {
+            name: updates.name,
+            description: updates.description,
+            steps: updates.steps?.map((s, i) => ({
+              handName: s.handName,
+              name: s.name || `Step ${i + 1}`,
+              params: s.params,
+              condition: s.condition,
+            })),
+          },
+        });
+        return result;
+      } catch {
+        return null;
+      }
     },
-    deleteWorkflow: async () => {
-      throw new Error('Workflow deletion not supported in KernelClient mode. Pipelines are file-based YAML definitions.');
+    deleteWorkflow: async (id) => {
+      try {
+        await invoke('pipeline_delete', { pipelineId: id });
+        return { status: 'deleted' };
+      } catch {
+        return { status: 'error' };
+      }
     },
     executeWorkflow: async (id: string, input?: Record<string, unknown>) => {
       try {