perf(build): isolate Core service capability profiles

[limityan]

Summary

• add explicit additive bitfun-core profiles for dispatch storage, LSP, terminal, local workspace runtime/watch, remote workspace facade, and concrete SSH
• make services-core default empty, isolate libgit2 memory-workspace behavior behind session-git, and move stable workspace/session identity helpers to that reusable owner
• keep remote registry, transport, authentication, SFTP/PTy, and lifecycle in integrations; preserve remote_ssh::paths as a compatibility re-export
• extend the existing Core boundary checker and module guides; no workflow or CI job is added

Architecture

This keeps bitfun-core as the compatibility facade and product-full composition root without using product-full as a shortcut for narrow builds.

• workspace-runtime owns local workspace/layout capabilities only.
• workspace-watch adds the identity watcher.
• remote-workspace adds the registry-backed remote facade without russh.
• ssh-remote adds concrete SSH transport.
• product-full explicitly restores all product-only owners, including permission, runtime ownership, session Git, dispatch, LSP, terminal, and workspace capabilities.
• Stable path normalization and identity hashing move to services-core::workspace_identity; remote runtime ownership does not move.

A registered remote path now fails explicitly when its file provider is unavailable instead of silently falling back to a same-named local path.

Dependency closure

Unique normal/build packages from cargo tree, compared with the exact pre-change Core feature-closure base:

Profile	Before	After	Change
bitfun-services-core default	155	89	-66 (-42.6%)
bitfun-core --no-default-features	258	145	-113 (-43.8%)
bitfun-core service-integrations	319	263	-56 (-17.6%)
bitfun-core ssh-remote	442	415	-27 (-6.1%)
bitfun-core product-full	712	712	unchanged

The empty Core profile no longer contains git2, SQLite, notify, terminal-core, services-integrations, or russh. The full product closure is intentionally unchanged.

Verification

Passed:

• pnpm run check:core-boundaries:test (33/33)
• pnpm run check:core-boundaries
• cargo test -p bitfun-core --no-default-features --features remote-workspace --lib registered_remote_path_without_file_provider_fails_closed
• cargo test -p bitfun-core --no-default-features --features dispatch-store --lib service::dispatch::tests (12/12)
• cargo test -p bitfun-services-core --no-default-features --features session-git memory_workspace (3/3)
• cargo test -p bitfun-services-integrations --no-default-features --features remote-ssh --test remote_ssh_contracts (9/9)
• cargo test -p bitfun-services-integrations --no-default-features --features remote-ssh --test remote_ssh_disabled_contracts (2/2)
• cargo check -p bitfun-core --no-default-features
• cargo check -p bitfun-core --no-default-features --features workspace-runtime
• cargo check -p bitfun-core --no-default-features --features remote-workspace
• cargo check -p bitfun-core --no-default-features --features ssh-remote
• cargo check -p bitfun-core --no-default-features --features product-full
• git diff --check gcwing/main...HEAD

cargo check --workspace reached unrelated app/native build prerequisites, then stopped because src/mobile-web/dist was absent for the Desktop Tauri build script and the sherpa-onnx prebuilt archive download ended early. No CI or product code was changed to mask those environment failures.

Review

An isolated adversarial review found one Important issue: remote provider absence could fall through to local filesystem access. The implementation now distinguishes an unregistered local path from a registered remote path with an unavailable provider, and the regression test proves the latter fails closed. Re-review result: Ready.