feat(acp): integrate runtime events and remote control

[wgqqqqq]

Summary

• Publish external ACP runtime activity through the shared AgenticEvent queue with explicit origin metadata.
• Persist ACP turns through a durable Desktop projection that survives reconnects and host restarts without loading them into SessionManager.
• Add capability-negotiated Remote Connect commands for ACP send, cancel, options, commands, plan, and permission responses.
• Route ACP permission requests through a shared mailbox and expose compatible behavior to Web UI and bot surfaces.
• Fail loudly when native controls target ACP sessions, while keeping older hosts and payloads classifiable.
• Document the runtime ownership, compatibility, and acceptance contracts.

Type and Areas

Type:

Feature / compatibility / test / docs

Areas:

Rust core, Desktop/Tauri, Remote Connect, ACP interface, Web UI, CLI, bot adapters, docs

Motivation / Impact

External ACP sessions were observable on Desktop but did not participate in the same durable event, reconnect, and remote-control contracts as native sessions. This change establishes a platform-neutral event and control path so mobile and other remote controllers can safely drive ACP sessions without silently falling back to native behavior.

Verification

• cargo test -p bitfun-desktop — 373 passed, 4 ignored
• cargo test -p bitfun-acp — 139 passed
• cargo test -p bitfun-services-integrations --no-default-features --features remote-connect --test remote_connect_contracts — 79 passed
• pnpm run type-check:web — passed
• pnpm --dir src/web-ui run test:run src/flow_chat/services/flow-chat-manager/EventHandlerModule.test.ts src/flow_chat/services/flow-chat-manager/PersistenceModule.test.ts — 64 passed
• git split verification confirmed this branch contains no src/apps/mobile/harmonyos changes and matches the host/shared portion of the integrated implementation exactly.
• Remote control was exercised on a real HarmonyOS device with send, durable single-turn projection, cancel, Desktop disconnect, and reconnect.
• Remote workspace scope and old-host behavior are covered by focused contracts; peer-device, detached-dispatch, and a pre-ACP Desktop binary were not exercised end to end.

Reviewer Notes

The HarmonyOS UI is intentionally split into a companion PR. This PR owns the protocol and host capability that the mobile surface negotiates. Existing clients remain readable through defaulted fields and explicit unsupported responses.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.

[wgqqqqq]

Companion HarmonyOS surface PR: #2455

[wgqqqqq]

Scope withdrawn in favor of the smaller HarmonyOS-only policy in #2455: ACP sessions are now hidden on mobile, so the Desktop runtime/control protocol changes in this PR are no longer needed.