feat(sdk): complete local application integration

[limityan]

Summary

• let a trusted local backend application import the private TypeScript SDK, start the package-local native Host, and use the existing BitFun Agent Runtime without installing BitFun or a CLI separately
• complete the minimal Query stream with assistant text, safe Tool lifecycle events, permission requests, terminal Result, cancellation, and cleanup
• add Query.respondPermission(...) for allow_once, allow_always, and reject, while keeping the existing Runtime PermissionRequestManager as the sole permission authority
• negotiate the actual Host capability matrix instead of implying unsupported features
• verify a real external project through npm pack -> local tarball install -> package-name import -> package-local Host initialize/close

Design boundary

The design follows the established SDK shape used by Codex SDK, Codex App Server, Claude Agent SDK permissions, Copilot SDK streaming events, and OpenCode V2 SDK: one ordered Query stream, an explicit permission response operation, capability negotiation, and a managed local runtime boundary.

This PR deliberately reuses the existing Agent Runtime, Tool events, permission manager, Query lifecycle, Rust wire contract, and managed Host. It does not add a second Runtime, generic reverse JSON-RPC callbacks, a Tool registry, or another transport layer.

Tool events expose only toolCallId, toolName, lifecycle status, progress, and duration. Raw Tool inputs, results, progress messages, errors, and cancellation reasons are not exposed by this boundary.

Public capability in this PR

• AgentClient.start(...) with package-local Host resolution
• transient and explicit Sessions
• Query start and ordered async event stream
• assistant text deltas
• safe Tool lifecycle events
• permission request plus allow_once / allow_always / reject
• cancellation, terminal Result, cleanup, and fail-closed Host loss behavior
• explicit capability matrix
• private local tarball consumption from an external project

Intentionally deferred

• custom function Tools
• MCP configuration and hooks
• generic user-input callbacks
• structured output and usage reporting
• Session resume/fork
• Python SDK
• browser/mobile runtimes that cannot launch a native Host
• npm/PyPI publication, platform packages, signing, download, and update infrastructure

Verification

• cargo check --workspace - passed after preparing the repository-required mobile-web artifact and reusing the machine's existing sherpa-onnx archive cache
• cargo test -p bitfun-sdk-host -p bitfun-sdk-host-app -q - passed, 72 tests
• pnpm --dir sdk/typescript run type-check - passed
• pnpm --dir sdk/typescript test - passed, 64 passed and 1 platform-specific skip
• pnpm --dir sdk/typescript run smoke:node - passed against the real package-local Host and fixture model server
• pnpm --dir sdk/typescript run smoke:consumer - passed in an isolated external project installed from a local tarball
• git diff --check gcwing/main...HEAD - passed
• independent adversarial review - no P0/P1 finding

cargo test --workspace -j 1 completed the full test build and then stopped on the existing bitfun-app-server test lightweight_client_negotiates_with_the_production_server: the production capability response omitted session/reloadContext. The failing test and capability implementation are byte-identical to current gcwing/main, and this PR does not modify app-server.

Bun is not available in the current shell, so the protocol v3 Bun smoke was not run. The SDK uses the same ESM build for Node and Bun, but Bun remains an explicit release-verification target rather than an unverified claim here.

Change control

• rebased onto gcwing/main at a10728f8e
• 2 focused commits
• 27 files, 1,954 insertions and 240 deletions (2,194 changed lines)
• no native binary, credential, npm/PyPI publication, or unrelated source change is committed