feat: 修复审计落差 #1/#2/#3/#6 + 管理面板移动端适配

#1 工具布尔标记生效(agent-106, 安全红线): loop toolSchemas/runToolCalls 加 allow-set 安全门 restrictSchemas/applyToolSecurityGate——群聊/陌生人只暴露允许工具(默认关), 被拒not_allowed软提示+AuditEvent, owner全工具不变; 身份靠 ActorEnv(非提示词)
#2 checkpoint 恢复(agent-109): run.go LoadLatest + resumableStopReason门控(只恢复in-flight工具循环,不出答案不续跑), 幂等不重放副作用, 新会话不误恢复; resume_test 4用例
#3 tool_result(agent-108, 协议层): Anthropic 原生tool_result块(tool_use_id/is_error)非user纯文本 + OpenAI tool消息补tool_call_id; Content加ToolCallID/IsError等; (loop接线层2处留待,见备注)
#6 capacity_awaken推送(agent-107): onCapacity从只Debug改推WS hub(BroadcastCapacityAwaken, sessionId定向+payload对齐前端AwakenPayload)
管理面板移动端(agent-110): AdminApp 汉堡菜单+抽屉侧栏+标题truncate防换行, RBAC守卫不受影响
全仓 build/vet/test绿 + 前端build绿; 前端无涉差异已对齐

备注: #3 loop接线层2处(assistant工具轮append历史 + Message.ToolCallID/IsError)留给后续; #4代审/#5子代理触发/#7拆文件后置(主人说后三不急)

cmd/cyrene/wire_test.go

@@ -0,0 +1,63 @@
+package main
+
+import (
+	"testing"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/capacity"
+)
+
+// fakeCapacityEmitter captures the capacity_awaken broadcast args so the
+// composition-root test can assert the wire forwards the transition to the sink.
+type fakeCapacityEmitter struct {
+	callCount int
+	sessionID string
+	fromState string
+	toState   string
+	tool      string
+}
+
+func (f *fakeCapacityEmitter) BroadcastCapacityAwaken(sessionID, fromState, toState, tool string) {
+	f.callCount++
+	f.sessionID = sessionID
+	f.fromState = fromState
+	f.toState = toState
+	f.tool = tool
+}
+
+// TestOnCapacityBroadcastsAwaken exercises the audit-gap fix (#6): a capacity
+// state transition received by the loop's OnCapacity sink is forwarded to the
+// gateway as a capacity_awaken broadcast carrying the originating session and the
+// frontend AwakenPayload fields (fromState, toState, tool).
+func TestOnCapacityBroadcastsAwaken(t *testing.T) {
+	fake := &fakeCapacityEmitter{}
+	a := &app{log: testLog(), capacitySink: fake}
+
+	a.onCapacity(capacity.Event{
+		Type:      capacity.EventAwaken,
+		FromState: capacity.StateQuiet,
+		ToState:   capacity.StateAwake,
+		Tool:      "web_search",
+		SessionID: "web",
+	})
+
+	if fake.callCount != 1 {
+		t.Fatalf("broadcast call count = %d, want 1", fake.callCount)
+	}
+	if fake.sessionID != "web" || fake.fromState != "quiet" || fake.toState != "awake" || fake.tool != "web_search" {
+		t.Fatalf("broadcast args = {sessionID:%q from:%q to:%q tool:%q}, want {web,quiet,awake,web_search}",
+			fake.sessionID, fake.fromState, fake.toState, fake.tool)
+	}
+}
+
+// TestOnCapacityNilSinkNoPanic locks the guard: a boot/degraded path where the
+// gateway is not yet wired must not panic — the sink is optional.
+func TestOnCapacityNilSinkNoPanic(t *testing.T) {
+	a := &app{log: testLog()}
+	a.onCapacity(capacity.Event{
+		Type:      capacity.EventAwaken,
+		FromState: capacity.StateQuiet,
+		ToState:   capacity.StateFull,
+		Tool:      "code",
+		SessionID: "web",
+	})
+}