feat(product): unify interactive capability control

[bobleer]

Summary

• establish src/shared/interactive-capabilities/catalog.json as the single semantic source for user-facing BitFun features and settings
• generate 38 bilingual manual pages, runtime search projections, and a separate exact audit of all 692 Desktop Tauri commands
• add the two-step BitFunControl Agent tool for list/search/get before open/execute/configure, and load it for every Agent when the product host registers it
• replace the settings-only global-search provider with bilingual feature-and-setting discovery and direct activation
• ship the BitFun Playbook site with its documentation sidebar, bilingual pages, responsive layout, system/light/dark themes, IME-safe live search, and preserved sidebar position
• make BitFun's built-in browser Agent-readable and controllable through the same target-neutral BrowserActions implementation used by external CDP browsers
• add generation contracts, focused tests, CI drift gates, immutable static releases, Nginx deployment, and production recovery documentation

Browser architecture

• BrowserActions owns snapshots, @eN refs, guarded clicks, filling, typing, scrolling, waits, evaluation, capture, cookies, fetch, and article reading once
• CdpClient and the Desktop native-WebView adapter both implement BrowserAutomationClient; frontend code only publishes native target lifecycle/visibility
• target: "builtin" | "external" selects the browser engine without changing the portable action contract; exact session id and URL/title matching work for both
• raw CDP, protocol tracing, backend node ids, native file-input injection, and true full-page capture remain explicit external-CDP extensions and fail loudly on native WebViews
• native load-finished maps to the shared load/DOMContentLoaded/network-idle lifecycle shape with an explicit approximation marker

Coverage

• 22 user-facing features
• 16 settings pages
• 297 documented user-facing items
• built-in browser element picker, element-to-session context, and Agent automation explicitly covered
• one semantic source feeds Markdown docs, Playbook, Global Search, BitFunControl discovery, and Agent control guidance

Verification

• pnpm run capabilities:check — 22 features, 16 settings, 692 Tauri commands
• interactive-capability contract tests — 8 passed
• Playbook tests — 6 passed; production build passed
• focused Web UI bridge/search tests — 20 passed
• pnpm run type-check:web
• browser-control Core tests — 33 passed
• ControlHub Core tests — 41 passed
• embedded WebDriver adapter tests — 2 passed
• CLI Peer policy tests — 5 passed
• Desktop Peer policy tests — 7 passed
• cargo check -p bitfun-webdriver
• cargo check -p bitfun-desktop
• cargo test -p bitfun-desktop — 323 passed, 4 ignored
• pnpm run check:core-boundaries
• repository hygiene and GitHub configuration checks
• production browser QA at https://playbook.openbitfun.com/ for bilingual input, themes, responsive/sidebar layout, sidebar scroll retention, and updated browser documentation

Remote and compatibility behavior

• Remote workspace: the native WebView lifecycle command is explicitly controller-local; workspace execution remains remote and never falls back to a controller filesystem
• Peer Device: controller-local WebView lifecycle is denied in the frontend, Desktop host, and CLI host lists, preventing accidental proxying to the peer
• CLI/headless and Detached Dispatch: no native browser host is advertised; built-in targeting returns explicit NOT_AVAILABLE, while external CDP remains available where configured
• upgrade compatibility: target selection is additive and defaults to the existing external-CDP behavior; no persisted shape is narrowed or reset
• local Desktop native adapter and all shared action contracts were compiled/tested; a packaged cross-platform native-WebView end-to-end smoke remains CI/release validation rather than evidence claimed by this PR