perf(build): make Tokio features crate-owned

[limityan]

Summary

• remove workspace-wide tokio/full and make each root-workspace crate select the runtime capabilities it actually owns
• keep test-only Tokio capabilities in dev-dependencies and bind integration runtime capabilities to the owning bitfun-services-integrations feature
• keep bitfun-core --no-default-features viable, including fail-closed outbound-claim cleanup that retains its durable recovery record
• extend the existing Cargo boundary checker with metadata-backed Tokio dependency checks, transitive feature-closure contracts, mutation tests, and focused integration-test gates

Architecture and scope

• Runtime ownership and public APIs do not move between layers in this PR.
• product-full remains the compatibility product assembly boundary; it is not added to any direct dependency or widened to make checks pass.
• Product-only Core modules and SSH-only helpers are gated by their existing owner features.
• Focused Core unit-test guidance now uses --lib, and remote_connect_host_boundary declares service-integrations, so unrelated product integration targets are not compiled for a no-default unit test.
• No GitHub workflow or additional CI suite is added. The new policy runs through the existing Core boundary checker.

Measured dependency impact

Target/profile	Before	After	Change
bitfun-runtime-ports normal unique package closure	40	27	-32.5%
bitfun-runtime-ports test unique package closure	48	31	-35.4%
bitfun-services-integrations plugin-source all-target closure	119	107	-10.1%
cold local runtime-ports test build	15.35 s	14.29 s	-6.9%
cold local plugin-source check	11.27 s	10.63 s	-5.7%

Cold timings are directional local Windows measurements; package-closure counts are the stable dependency evidence.

Validation

• node --test scripts/check-core-boundaries.test.mjs ? 32/32 passed
• all 19 changed bitfun-services-integrations features checked independently with --no-default-features --lib
• cargo check -p bitfun-core --no-default-features
• no-default fail-closed dispatch cleanup test ? 1/1 passed
• existing default dispatch claim release/retry tests ? 2/2 passed
• focused plugin-source tests ? 60/60 passed
• focused MiniApp host dispatch test ? 1/1 passed
• cargo check --workspace --quiet
• cargo metadata --locked --no-deps --format-version 1
• independent adversarial review: Critical 0, Important 0, ready to merge

The workspace check reports only pre-existing CLI unused-code/import warnings.

Follow-up kept explicit

bitfun-core's standalone service-integrations and ssh-remote feature profiles are not yet fully closed. This PR deliberately does not mask that work by attaching product-full; the next dependency-boundary PR will resolve those owner relationships directly.