feat(agent): unify agnet→agent and implement client/runtime unification spec v0.1 core

按桌面客户端统一方案 v0.1 + agent_management Sub Mode Runtime 对接,强制全量统一,不留兼容。

命名统一(强制,无兼容):
- 全仓 agnet/Agnet/AGNET → agent/Agent/AGENT:后端 Go(路由 /api/agent/*、env AGENT_*、
  结构体/函数、19 个文件改名)、前端(agent-console/agent-hub、/api/agent 调用、i18n)、
  DB(表 agent_*、列 agent_id)、compose/.env、文档、脚本。
- DB 加幂等迁移 renameAgnetTablesToAgent():启动时 rename 老 agnet_* 表/列,保住生产数据。

统一方案核心(10 项):
- callback 统一 /api/agent/callbacks/runtime-events(路由/广播URL/函数名)。
- artifact 兜底判定改用 Runtime 权威信号 metadata.synthesized(§7.2)+ 结构化 artifact_type。
- Manager→Runtime 路径对齐 /api/agent/sub-agile/deployments(§2.2),{deployment_id} 回退 swarm_id。
- 状态裁决 display_status:Manager 唯一裁判,completed 无有效产物→needs_codegen/
  completed_without_deliverable(§10.6),接入 detail/timeline/workflow。
- GET /api/heicode/capabilities 能力发现(§6)。
- 模型策略 per_role(role_models)+ 收集 allowed_model_ids(§9)。
- resource_binding_id→secret_ref 服务端解析,客户端不再 inline secret_ref(§17.6)。
- 客户端统一路由层 /api/heicode/sub-agile|swarm/*(task≡deployment,复用控制面)+ workflow 投影。
- 日志分层 user_logs/debug_logs(§13)。

验证:go build ./... + go test(controller/router/model/middleware)全绿;前端 tsc -b + rsbuild build 通过。
待部署:VM .env 的 AGNET_*→AGENT_*;启动迁移自动 rename 表;其他三仓库需同步切到 /api/agent。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

heicode/controller/resource_test.go

@@ -120,7 +120,7 @@ func TestDeleteResourceRevokesBindingAndActiveGrants(t *testing.T) {
 		BindingScope:    "project-alpha",
 		ResourceId:      resource.Id,
 		Role:            "backend",
-		AgnetId:         "agent-backend-1",
+		AgentId:         "agent-backend-1",
 		PermissionScope: `{"actions":["repo:read"]}`,
 		Status:          "active",
 	}
@@ -159,7 +159,7 @@ func TestDeleteResourceRevokesBindingAndActiveGrants(t *testing.T) {
 	require.Contains(t, listActive.Body.String(), `"items":[]`)
 }
 
-func TestCreateResourceGrantAssignsBoundResourceToRoleAgnet(t *testing.T) {
+func TestCreateResourceGrantAssignsBoundResourceToRoleAgent(t *testing.T) {
 	db := setupResourceControllerTestDB(t)
 	resource := model.ResourceBinding{
 		UserId:       7,
@@ -177,7 +177,7 @@ func TestCreateResourceGrantAssignsBoundResourceToRoleAgnet(t *testing.T) {
 		"binding_scope":"https://example.com/sk.git#main",
 		"resource_id":%d,
 		"role":"developer",
-		"agnet_id":"agnet-dev-1",
+		"agent_id":"agent-dev-1",
 		"permission_scope":{"actions":["read"]},
 		"constraints":{"paths":["skills/**"]}
 	}`, resource.Id)
@@ -187,14 +187,14 @@ func TestCreateResourceGrantAssignsBoundResourceToRoleAgnet(t *testing.T) {
 	require.Contains(t, w.Body.String(), `"success":true`)
 	require.Contains(t, w.Body.String(), `"binding_scope":"https://example.com/sk.git#main"`)
 	require.Contains(t, w.Body.String(), `"role":"developer"`)
-	require.Contains(t, w.Body.String(), `"agnet_id":"agnet-dev-1"`)
+	require.Contains(t, w.Body.String(), `"agent_id":"agent-dev-1"`)
 
 	var grant model.ResourceGrant
 	require.NoError(t, db.First(&grant).Error)
 	require.Equal(t, resource.Id, grant.ResourceId)
 	require.Equal(t, "https://example.com/sk.git#main", grant.BindingScope)
 	require.Equal(t, "developer", grant.Role)
-	require.Equal(t, "agnet-dev-1", grant.AgnetId)
+	require.Equal(t, "agent-dev-1", grant.AgentId)
 }
 
 func TestCreateResourceGrantRejectsMismatchedBindingScope(t *testing.T) {
@@ -212,7 +212,7 @@ func TestCreateResourceGrantRejectsMismatchedBindingScope(t *testing.T) {
 		"binding_scope":"azure-vm-dev",
 		"resource_id":%d,
 		"role":"operator",
-		"agnet_id":"agnet-ops-1"
+		"agent_id":"agent-ops-1"
 	}`, resource.Id)
 
 	w := performResourceRequest(CreateResourceGrant, 7, http.MethodPost, "/", body)
@@ -241,7 +241,7 @@ func TestGenerateResourceGrantManifestIncludesActiveGrantsOnly(t *testing.T) {
 		BindingScope:    "repo-main",
 		ResourceId:      resource.Id,
 		Role:            "backend",
-		AgnetId:         "agnet-backend-1",
+		AgentId:         "agent-backend-1",
 		PermissionScope: `{"actions":["read"]}`,
 		Constraints:     `{"paths":["heicode/controller/**"]}`,
 		Status:          "active",
@@ -251,7 +251,7 @@ func TestGenerateResourceGrantManifestIncludesActiveGrantsOnly(t *testing.T) {
 		BindingScope:    "repo-main",
 		ResourceId:      resource.Id,
 		Role:            "backend",
-		AgnetId:         "agnet-backend-1",
+		AgentId:         "agent-backend-1",
 		PermissionScope: `{"actions":["write"]}`,
 		Status:          "revoked",
 	}).Error)
@@ -261,7 +261,7 @@ func TestGenerateResourceGrantManifestIncludesActiveGrantsOnly(t *testing.T) {
 		7,
 		http.MethodGet,
 		"/manifest",
-		"/manifest?binding_scope=repo-main&role=backend&agnet_id=agnet-backend-1",
+		"/manifest?binding_scope=repo-main&role=backend&agent_id=agent-backend-1",
 		"",
 	)
 
@@ -269,7 +269,7 @@ func TestGenerateResourceGrantManifestIncludesActiveGrantsOnly(t *testing.T) {
 	require.Contains(t, w.Body.String(), `"success":true`)
 	require.Contains(t, w.Body.String(), `"binding_scope":"repo-main"`)
 	require.Contains(t, w.Body.String(), `"agent_role":"backend"`)
-	require.Contains(t, w.Body.String(), `"target_agent_ref":"agnet-backend-1"`)
+	require.Contains(t, w.Body.String(), `"target_agent_ref":"agent-backend-1"`)
 	require.Contains(t, w.Body.String(), `"resource_type":"git"`)
 	require.Contains(t, w.Body.String(), `"allowed_actions":["read"]`)
 	require.Contains(t, w.Body.String(), `"secret_ref":"azkv://heicode-kv.vault.azure.net/secrets/repo-main"`)
@@ -293,7 +293,7 @@ func TestDeleteResourceGrantRevokesInsteadOfDeleting(t *testing.T) {
 		BindingScope:    "project-alpha",
 		ResourceId:      resource.Id,
 		Role:            "backend",
-		AgnetId:         "agent-backend-1",
+		AgentId:         "agent-backend-1",
 		PermissionScope: `{"actions":["repo:read","repo:write"]}`,
 		Constraints:     `{"paths":["src/**"]}`,
 		Status:          "active",