refactor(connector): establish owned subsystem boundaries

[chovy-ai]

Summary

Refactor Connector into a high-cohesion, low-coupling subsystem owned by Tutti, with one composition root and narrow interface groups.

• Introduce the contracts -> application core boundary and keep daemon, runtime, SQLite storage, and Market source as independently injected outer adapters.
• Move process primitives under Connector runtime, remove the Agent runtime dependency, separate implementation commands from physical route observation, and add exact desired/observed reconciliation, persistent failure budgets, worker health, and bounded lifecycle control.
• Make Catalog snapshots atomic and last-good, terminate the Market protocol in market/source, consume server-owned release digests, and migrate installed-release evidence once without runtime legacy fallback.
• Add structured command outcomes, revision fences, and crash-recoverable authorization cancellation receipts.
• Make application the sole source of canonical Connector presentation and admitted semantic actions. Unknown states fail closed.
• Move all Connector entry/content UI into /renderer; keep /ui as a one-version forwarding entry. Agent GUI now exposes only a neutral primaryCapability slot and knows no Connector types, status, copy, or navigation.
• Keep Desktop as the host adapter for transport mapping, shared-Agent policy injection, and semantic navigation events.
• Add Go/TS dependency gates and completed execution records under docs/refactors/connector.

Artifact delivery is paired with tsh-server PR #849. The generated Market client source lock pins its final protocol commit.

Verification

• pnpm check:changed -- --push-ready — 84/84 lanes passed in the actual pre-push hook.
• pnpm check:connector-boundaries
• pnpm check:api-generated
• Connector Market: 91/91 tests, typecheck, and build.
• Desktop Connector: 14/14 focused tests, typecheck, full build, and CSS contracts.
• Agent GUI: 61/61 focused tests, typecheck, build, and degradation gate.
• Connector contracts/application/daemon/runtime/store/source: normal tests, race tests, vet, golangci-lint, and Windows amd64 cross-compile.
• DCO sign-off verified for every commit on the branch.

Fallback Three Questions

• Source: physical routes can disappear between observations, remote Catalog reads currently have no server snapshot revision, and a dispatched command may time out before its authoritative result is observed.
• Why can it not be fixed at that source? OS processes and transports cannot guarantee a lossless watch across crashes; the current server API does not expose a Catalog snapshot revision; post-dispatch timeout ambiguity is inherent across a process boundary.
• Removal condition: replace the double Catalog read when the server exposes a signed snapshot revision; remove compatibility wire fields after the one-version migration window; retain physical anti-entropy until the implementation host provides a durable resumable observation log with revision proof.

Checklist

• Not applicable: this PR does not change Agent session/turn/goal/runtime-operation lifecycle semantics; Connector lifecycle remains in the Connector subsystem.
• I kept the change focused on one concern: establishing the Connector subsystem boundary and migrating its owned capabilities.
• I updated documentation when behavior, setup, or contributor workflow changed.
• Not applicable: no README/CONTRIBUTING language-source change requires variant updates.
• I ran the lowest meaningful local checks for the changed surface, plus the full push-ready changed-target matrix.
• My commits are signed off with DCO when required: git commit -s.