fix(extensions): clarify runtime recovery and config failures - #1603

What changed

• Align architecture, rollout, CLI, and adapter documentation with the shipped OpenCode Command, standalone Tool, and Subagent slices.
• Explain that the shared Node.js runtime is discovered on first external-tool runtime initialization and cached for the process. Desktop and TUI now tell users to install or repair Node.js and restart BitFun; refresh is not presented as a PATH reload.
• Stop reporting an unchecked Node.js version as verified.
• Fail closed when BitFun cannot read model settings for external Subagents, instead of falling back to a default config or misreporting a model mismatch.
• Represent that recoverable fault as Unavailable, block approval and registration, log only a deduplicated sanitized error category, and reuse the previous approval and same-name conflict choice after recovery.
• Add provider-neutral GUI/TUI diagnostics and regression coverage for temporary unavailability, restart guidance, and recovery without repeated consent.

Product and architecture impact

This PR does not add a new extension type or runtime. Ecosystem parsing remains in the OpenCode adapter, provider-neutral activation remains in the shared external-source path, and execution remains in the existing Tool and Subagent owners. GUI and interactive TUI consume the same typed state with surface-specific copy. Remote workspaces remain explicitly unsupported for these local sources.

Package plugins, Hooks, remote execution, OS sandboxing, process-tree limits, global budgets, watcher changes, full metrics, and runtime hot replacement remain deferred. System prompts, permission policy, persisted preference schemas, dependency manifests, and remote routing are unchanged.

Independent review

Separate adversarial architecture and product reviews identified and verified fixes for:

• inaccurate startup-time Node.js lifecycle wording;
• recoverable configuration faults being shown as unsupported;
• insufficient sanitized diagnostic detail; and
• transient configuration faults invalidating an existing same-name conflict choice.

No P0-P2 findings remain after the final read-only review.

Validation

• rustup run nightly cargo check --workspace
• rustup run nightly cargo test -p bitfun-core model_config -- --nocapture (5 passed)
• rustup run nightly cargo test -p bitfun-cli external_tool_runtime_recovery_explains_that_bitfun_must_restart -- --nocapture
• rustup run nightly cargo test -p bitfun-cli external_review_copy_classifies_unknown_locations_and_agent_diagnostics_safely -- --nocapture
• rustup run nightly cargo test -p bitfun-services-integrations --features script-tool-runtime --test script_tool_runtime runtime_availability_does_not_claim_an_unchecked_node_version -- --nocapture
• pnpm --dir src/web-ui run test:run src/infrastructure/config/components/ExternalSourcesConfig.test.tsx (15 passed)
• pnpm run type-check:web
• pnpm run i18n:audit (0 warnings)
• pnpm run check:repo-hygiene
• node scripts/check-core-boundaries.mjs
• git diff --check

The installed stable Rust components are inconsistent locally, so Rust formatting and local Rust verification used the installed nightly toolchain. CI remains the stable-toolchain verification.