feat: complete Creative mode

[bobleer]

Summary

• add the production Creative agent and make it the only built-in primary mode that defaults to MiniApp create/finalize/publish tools and the related miniapp-dev / bitfun-frontend-dev skills
• move the packaged desktop frontend out of Tauri's immutable embedded frontend assets into a versioned app-data workbench, with draft preparation, hot activation, an immutable 15-second confirmation window, automatic timeout/startup rollback, and explicit rollback
• enable Creative in the Web UI harness and make the MiniApp gallery create action start a local Creative session
• add explicit capability, tool-provider, packaging, peer-device, remote-workspace, upgrade-state, architecture, and contract coverage

Type and Areas

Type: Feature / UI/UX / architecture / test

Areas: Rust core, product assembly, desktop/Tauri, web UI, CLI peer policy, packaging, docs

Motivation / Impact

Creative mode is now a real product mode rather than a coming-soon UI entry. Product-creation powers no longer appear by default in general coding, Cowork, or Claw modes. Packaged BitFun builds can safely let Creative edit the running client frontend while retaining a host-owned recovery path if the candidate UI is broken or the user does not confirm it.

Upgrade compatibility is additive: the workbench state schema defaults missing fields, preserves unreadable state for diagnosis, and never requires manual migration. A newly packaged frontend becomes the safe active revision after an app upgrade while retaining the previous valid revision for rollback.

Verification

Passed locally:

• pnpm install --frozen-lockfile
• pnpm run prepare:mobile-web
• pnpm run frontend:build-all (also passed again after rebasing onto current upstream)
• pnpm --dir src/web-ui exec vitest run src/flow_chat/components/HarnessProfileSelector.test.tsx src/flow_chat/utils/chatInputExecutionLevelPolicy.test.ts src/infrastructure/api/adapters/peer-device-adapter.test.ts — 66 passed
• pnpm run i18n:audit
• pnpm --dir src/web-ui run gen:types
• pnpm run check:repo-hygiene
• pnpm run check:core-boundaries
• pnpm run check:core-boundaries:test — 138 passed
• node --test scripts/desktop-tauri-build.test.mjs — 14 passed
• cargo build -p bitfun-desktop
• cargo check -p bitfun-core --features product-full
• cargo check -p bitfun-core --no-default-features --features tools-creation
• focused tests for agent content, agent definitions, skill policy, product capabilities, tool packs, desktop frontend workbench, remote-workspace command policy, and all three peer-device deny lists
• skill validator for bitfun-frontend-dev

Remote scenario evidence:

• remote workspace: the gallery entry and tool execution reject it explicitly; covered by a focused Rust test and the Tauri command-policy contract
• Peer Device Mode: confirmation commands stay local in all three synchronized deny lists, and the host tool rejects use while a peer controller is attached; covered by Rust and Web UI tests
• detached / CLI / ACP / SDK profiles: Creative and core.creation are not assembled into these headless or narrow profiles; product-capability contracts pass
• interactive desktop confirmation-window behavior was not manually exercised in this headless worktree; host state, timeout/expiry, startup recovery, immutable recovery page, path safety, and packaging are covered automatically

Reviewer Notes

The full Web UI remains built normally, but official desktop packaging adds it as frontend/dist; Tauri's frontendDist contains only immutable bootstrap/recovery pages. At runtime the desktop adapter copies a fingerprinted bundled revision into app data and serves the active revision through bitfun-ui://localhost/ with no-store semantics.

The new Core host callback is an internal platform-neutral port. Its deletion condition is retirement or replacement of the packaged-frontend workbench; desktop-specific storage, windows, timers, and navigation remain in the desktop adapter.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.