feat: P0 KernelClient功能修复 + P1/P2/P3质量改进

P0 KernelClient 功能断裂修复:
- Skill CUD: registry.rs create/update/delete + serialize_skill_md + kernel proxy
- Workflow CUD: pipeline_commands.rs create/update/delete + serde_yaml依赖
- Agent更新: registry update方法 + AgentConfigUpdated事件 + agent_update命令
- Hand流式事件: HandStart/HandEnd变体替换ToolStart/ToolEnd
- 后端验证: hand_get/hand_run_status/hand_run_list确认实现完整
- Approval闭环: respond_to_approval后台spawn+5分钟超时轮询

P2/P3 质量改进:
- Browser WebDriver: TCP探测ChromeDriver/GeckoDriver/Edge端口替换硬编码true
- api-fallbacks: 移除假技能和16个捏造安全层，替换为真实能力映射
- dead_code清理: 移除5个模块级#![allow(dead_code)]，删除3个真正死方法，
  删除未注册的compactor_compact_llm命令，warnings从8降到3
- 所有变更通过cargo check + tsc --noEmit验证

desktop/src-tauri/src/intelligence/compactor.rs

@@ -14,7 +14,6 @@
 // NOTE: #[tauri::command] functions are registered via invoke_handler! at runtime,
 // which the Rust compiler does not track as "use". Module-level allow required
 // for Tauri-commanded functions. Genuinely unused methods annotated individually.
-#![allow(dead_code)]
 
 use serde::{Deserialize, Serialize};
 use regex::Regex;
@@ -99,6 +98,8 @@ pub struct CompactionCheck {
 }
 
 /// Configuration for LLM-based summary generation
+/// NOTE: Reserved for future LLM compaction Tauri command
+#[allow(dead_code)]
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct LlmSummaryConfig {
     pub provider: String,
@@ -250,6 +251,7 @@ impl ContextCompactor {
     /// - `use_llm` is false
     /// - LLM config is not provided
     /// - LLM call fails and `llm_fallback_to_rules` is true
+    #[allow(dead_code)] // Reserved: Tauri command removed during refactor, will be re-registered
     pub async fn compact_with_llm(
         &self,
         messages: &[CompactableMessage],
@@ -499,18 +501,6 @@ impl ContextCompactor {
 
         conclusions.into_iter().take(3).collect()
     }
-
-    /// Get current configuration
-    #[allow(dead_code)] // Reserved: no Tauri command yet
-    pub fn get_config(&self) -> &CompactionConfig {
-        &self.config
-    }
-
-    /// Update configuration
-    #[allow(dead_code)] // Reserved: no Tauri command yet
-    pub fn update_config(&mut self, updates: CompactionConfig) {
-        self.config = updates;
-    }
 }
 
 // === Tauri Commands ===
@@ -561,33 +551,6 @@ pub async fn compactor_compact(
     result
 }
 
-/// Execute compaction with optional LLM-based summary
-#[tauri::command]
-pub async fn compactor_compact_llm(
-    messages: Vec<CompactableMessage>,
-    agent_id: String,
-    conversation_id: Option<String>,
-    compaction_config: Option<CompactionConfig>,
-    llm_config: Option<LlmSummaryConfig>,
-) -> CompactionResult {
-    let memory_flush = compaction_config
-        .as_ref()
-        .map(|c| c.memory_flush_enabled)
-        .unwrap_or(false);
-    let flushed = if memory_flush {
-        flush_old_messages_to_memory(&messages, &agent_id, conversation_id.as_deref()).await
-    } else {
-        0
-    };
-
-    let compactor = ContextCompactor::new(compaction_config);
-    let mut result = compactor
-        .compact_with_llm(&messages, &agent_id, conversation_id.as_deref(), llm_config.as_ref())
-        .await;
-    result.flushed_memories = flushed;
-    result
-}
-
 /// Flush important messages from the old (pre-compaction) portion to VikingStorage.
 ///
 /// Extracts user messages and key assistant responses as session memories

desktop/src-tauri/src/intelligence/heartbeat.rs

@@ -93,7 +93,7 @@ pub enum HeartbeatStatus {
 
 /// Type alias for heartbeat check function
 #[allow(dead_code)] // Reserved for future proactive check registration
-pub type HeartbeatCheckFn = Box<dyn Fn(String) -> std::pin::Pin<Box<dyn std::future::Future<Output = Option<HeartbeatAlert>> + Send>> + Send + Sync>;
+type HeartbeatCheckFn = Box<dyn Fn(String) -> std::pin::Pin<Box<dyn std::future::Future<Output = Option<HeartbeatAlert>> + Send>> + Send + Sync>;
 
 // === Default Config ===
 

desktop/src-tauri/src/intelligence/identity.rs

@@ -13,10 +13,8 @@
 //! NOTE: Some methods are reserved for future integration.
 
 // NOTE: #[tauri::command] functions are registered via invoke_handler! at runtime,
-// which the Rust compiler does not track as "use". This module-level allow is
-// required for all Tauri-commanded functions. Only genuinely unused non-command
-// methods have individual #[allow(dead_code)] annotations below.
-#![allow(dead_code)]
+// which the Rust compiler does not track as "use". Module-level allow required
+// for Tauri-commanded functions. Genuinely unused methods annotated individually.
 
 use chrono::Utc;
 use serde::{Deserialize, Serialize};
@@ -541,6 +539,7 @@ pub type IdentityManagerState = Arc<Mutex<AgentIdentityManager>>;
 
 /// Initialize identity manager
 #[tauri::command]
+#[allow(dead_code)] // Registered via invoke_handler! at runtime
 pub async fn identity_init() -> Result<IdentityManagerState, String> {
     Ok(Arc::new(Mutex::new(AgentIdentityManager::new())))
 }

desktop/src-tauri/src/intelligence/reflection.rs

@@ -583,12 +583,6 @@ impl ReflectionEngine {
         self.history.iter().rev().take(limit).collect()
     }
 
-    /// Get last reflection result
-    #[allow(dead_code)] // Reserved: no Tauri command yet
-    pub fn get_last_result(&self) -> Option<&ReflectionResult> {
-        self.history.last()
-    }
-
     /// Get current state
     pub fn get_state(&self) -> &ReflectionState {
         &self.state

desktop/src-tauri/src/intelligence/validation.rs

@@ -5,8 +5,6 @@
 //!
 //! NOTE: Some functions are defined for future use and external API exposure.
 
-#![allow(dead_code)] // Validation functions reserved for future API endpoints
-
 use std::fmt;
 
 /// Maximum length for identifier strings (agent_id, pipeline_id, skill_id, etc.)
@@ -201,6 +199,7 @@ pub fn validate_string_length(value: &str, field_name: &str, max_length: usize)
 /// Validate an optional identifier field
 ///
 /// Returns Ok if the value is None or if it contains a valid identifier.
+#[allow(dead_code)] // Reserved for optional-ID Tauri commands
 pub fn validate_optional_identifier(value: Option<&str>, field_name: &str) -> Result<(), ValidationError> {
     match value {
         None => Ok(()),
@@ -210,6 +209,7 @@ pub fn validate_optional_identifier(value: Option<&str>, field_name: &str) -> Re
 }
 
 /// Validate a list of identifiers
+#[allow(dead_code)] // Reserved for batch-ID Tauri commands
 pub fn validate_identifiers<'a, I>(values: I, field_name: &str) -> Result<(), ValidationError>
 where
     I: IntoIterator<Item = &'a str>,
@@ -221,6 +221,7 @@ where
 }
 
 /// Sanitize a string for safe logging (remove control characters, limit length)
+#[allow(dead_code)] // Reserved for log-sanitization Tauri commands
 pub fn sanitize_for_logging(value: &str, max_len: usize) -> String {
     let sanitized: String = value
         .chars()