perf(server): narrow App Server feature closures

[limityan]

Summary

• replace App Server's bitfun-core/product-full with the reviewed agent-runtime owner closure;
• replace the paused Web Server's product-full closure with agent-runtime,ssh-remote, while keeping the inactive dispatch/external-source sources compilable only through the non-default paused-web-server-source-check profile;
• keep Web Server, Remote Connect Relay, the inactive AI relay draft, and SSH execution boundaries distinct; the Web Server remains paused rather than deprecated or retired;
• make Server workspace bootstrap source-aware and ownership-first, including first creation of the default Assistant workspace, then construct/register/start Cron only after the workspace is owned;
• preserve typed host_capability_unavailable responses for the exact external-source and external-Hook command set, and keep WebSocket Ping/Pong from terminating the JSON-RPC stream;
• lock App Server default/ts and Server default/source-check direct and transitive feature closures with the existing repository boundary checker.

Dependency impact

Entry point	Before	After	Change
App Server normal/build	545	421	-124 (-22.8%)
Paused Web Server default normal/build	565	497	-68 (-12.0%)
Paused Web Server source-check	n/a	544	non-default source-health profile only

Counts use the same Windows cargo tree --locked -e normal,build unique-node method. They describe graph size, not a fixed wall-clock guarantee. The four direct optional dependencies needed by inactive Server sources are enabled only by source-check; the default profile does not activate them. No new CI job or Cargo [[test]] target is added. The existing cross-platform file-watch step keeps the same target and matrix; it only gains a five-minute step timeout so a stalled native watcher produces a bounded failure instead of occupying the runner for the workflow-wide timeout.

Workspace behavior

• explicit --workspace: authoritative local input; validation, ownership, or open failure stops startup and never selects a different directory;
• no explicit input: persisted local history is advisory; failure falls back to the default Assistant workspace through the same ownership boundary;
• Remote history: skipped because the paused Host has no SSH manager, then falls back to the default Assistant workspace;
• default Assistant workspace: its initial directory allocation, open, and preparation occur under a reversible Runtime ownership claim; failure stops startup;
• legacy default Assistant directory: used in place and classified as Assistant when the current directory is absent, without migrating it before ownership.

Validation

• cargo check -p bitfun-server
• cargo test -p bitfun-server (10/10)
• cargo test -p bitfun-server --features paused-web-server-source-check (20/20)
• cargo test -p bitfun-app-server (unit, integration, and doctests)
• cargo test -p bitfun-services-core --no-default-features --features runtime-ownership --test runtime_ownership_contracts (4/4)
• focused Core ownership/workspace/history tests (3 + 4 + 1 + 1 + 1)
• node --test scripts/check-core-boundaries.test.mjs (71/71)
• node scripts/check-core-boundaries.mjs
• focused Web ExternalHooks/ExternalSources/ApiClient tests (46/46)
• pnpm run check:repo-hygiene
• pnpm run check:github-config (8/8)
• exact Windows file-watch target (50/50 repeated local runs; 24/24 concurrent isolated problem-case processes)
• git diff --check gcwing/main HEAD

CI diagnostic note

The replacement run for the prior head (30919504209) passed 6/7 jobs, including the macOS path that had failed deterministically before. Its Windows job compiled the existing file-watch target in 7.97 seconds and completed 8/9 cases, then file_watch_publishes_debounced_batches_to_backend_subscribers stopped making progress for more than 30 minutes. The run was cancelled to obtain the otherwise unavailable in-progress log; it was not rerun to hide the stall.

The incident is localized to an existing Windows native-watcher lifecycle path, but current evidence does not distinguish registration, timeout unwind, and teardown. The PR therefore does not claim a production root-cause fix or serialize away multi-watcher coverage. It only bounds the existing CI step at five minutes and locks that policy in the existing GitHub configuration contract. A recurrence remains a diagnostic failure that requires hang/thread-state evidence.

Adversarial review

Two independent rounds reviewed runtime ownership/behavior and dependency/API/transport boundaries. Findings fixed before submission:

• split Server default/source-check and App Server default/ts closure simulation so an additive strongest profile cannot hide default dependency leakage;
• include the ExternalHooks facade in the exact typed unsupported-method set;
• restore legacy Assistant workspace compatibility without ownership-before-migration side effects;
• move default workspace directory creation inside a stable candidate-key ownership claim, eliminating the create-before-lease race.

The final follow-up review found no remaining P0-P3 issue. Broad workspace test suites were intentionally not added to local or CI validation.