feat(mentions): centralize rich text mention resolution

[jomeswang]

Summary

• add a host-scoped RichTextMentionService with exact identity resolution, single-flight caching, bounded TTL/LRU behavior, keyed invalidation, diagnostics, and React adapters
• extend workspace external contracts with optional at.resolve / at.subscribe, preserving old-host query fallback and enforcing workspace-app host boundaries
• wire Desktop workspace and standalone roots, AgentGUI Markdown/node views, and the shared MentionPill fallback so app/group-chat/readonly mentions render icons consistently
• document the durable identity-only Markdown contract and add package boundary protection

Supersedes #1314.

Validation

• pnpm check:full — 18/18 tasks passed
• pnpm check:changed — 18/18 lanes passed
• AgentGUI full suite — 1,796 tests passed
• Desktop full suite — 1,489 passed, 2 skipped
• ui-rich-text — 107 tests passed
• workspace-external-core — 44 tests passed
• package builds and packed export verification passed
• three independent review passes completed; all correctness/security blockers resolved

Compatibility

Legacy providers and old workspace-app hosts continue to work. New consumers can register the service once at the host root; presentation metadata remains runtime-only and is not serialized into Markdown.

---