perf(build): isolate services-core capability profiles

[limityan]

Summary

• gate concrete filesystem, local-storage, process-runtime, and workspace-instruction owners behind four additive bitfun-services-core capability features
• make Core, CLI, AI subscription auth, and services integrations select only the capabilities their real imports require; no narrow path enables product-full
• isolate Tokio, Unix libc, and Windows API capabilities at the same owner boundary, including explicit lsp -> process-runtime composition
• split mixed integration targets and protect exact profiles, source gates, Tokio ownership, and Windows dependency feature ownership in the existing boundary checker

Architecture

Runtime ownership and public paths do not move. services-core remains the concrete reusable service owner, Core remains the compatibility/product assembly facade, and product-full explicitly composes the same behavior. This change adds no crate, provider, registry, workflow, or third-party dependency.

Dependency closure

Windows/Linux counts are unique normal-dependency packages from cargo tree --no-default-features against the PR base.

Profile	Before	After	Reduction
bitfun-services-core Windows empty	70	22	-48 (-68.6%)
bitfun-services-core Linux empty	55	22	-33 (-60.0%)
bitfun-core Windows empty	113	89	-24 (-21.2%)
Codex adapter Windows empty	115	78	-37 (-32.2%)

The empty services-core profile now carries only Tokio rt and time; filesystem, storage, process, synchronization, Unix signal, and Windows API capabilities are selected by their owners.

Validation

• pnpm run check:core-boundaries:test (36/36)
• pnpm run check:core-boundaries
• Windows and Linux cargo check --locked for services-core empty, filesystem, local-storage, process-runtime, workspace-instructions, lsp, and workspace-runtime
• focused services-core tests for empty, storage/session, process, instruction, LSP, workspace runtime, runtime ownership, and session-git profiles
• Core empty, capability, LSP, workspace-runtime, and product-full checks
• individual checks for affected services-integrations features, AI subscription auth, and CLI
• pnpm run fmt:rs
• git diff --check

The broad workspace check was not completed locally; existing CI remains the broad merge gate. No CI or workflow configuration is changed by this PR.

Review

Independent adversarial review found and closed feature-unification gaps in LSP process ownership, Tokio/libc capabilities, Windows API feature ownership, and source-gate enforcement. The final review reported no remaining P0-P2 findings.