feat: 修复审计落差 #1/#2/#3/#6 + 管理面板移动端适配

#1 工具布尔标记生效(agent-106, 安全红线): loop toolSchemas/runToolCalls 加 allow-set 安全门 restrictSchemas/applyToolSecurityGate——群聊/陌生人只暴露允许工具(默认关), 被拒not_allowed软提示+AuditEvent, owner全工具不变; 身份靠 ActorEnv(非提示词)
#2 checkpoint 恢复(agent-109): run.go LoadLatest + resumableStopReason门控(只恢复in-flight工具循环,不出答案不续跑), 幂等不重放副作用, 新会话不误恢复; resume_test 4用例
#3 tool_result(agent-108, 协议层): Anthropic 原生tool_result块(tool_use_id/is_error)非user纯文本 + OpenAI tool消息补tool_call_id; Content加ToolCallID/IsError等; (loop接线层2处留待,见备注)
#6 capacity_awaken推送(agent-107): onCapacity从只Debug改推WS hub(BroadcastCapacityAwaken, sessionId定向+payload对齐前端AwakenPayload)
管理面板移动端(agent-110): AdminApp 汉堡菜单+抽屉侧栏+标题truncate防换行, RBAC守卫不受影响
全仓 build/vet/test绿 + 前端build绿; 前端无涉差异已对齐

备注: #3 loop接线层2处(assistant工具轮append历史 + Message.ToolCallID/IsError)留给后续; #4代审/#5子代理触发/#7拆文件后置(主人说后三不急)

internal/runtime/loop/loop.go

@@ -24,7 +24,6 @@ import (
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/guardrail"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/memory"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
-	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/persist"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/tool"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/trace"
 )
@@ -89,7 +88,7 @@ type Loop struct {
 	retriever       *memory.Retriever
 	working         *memory.WorkingMemory
 	extractor       memory.Extractor
-	checkpoint      *persist.Store
+	checkpoint      checkpointStore
 	tracer          *trace.Tracer
 	guards          *guardrail.Pipeline
 	personaID       string
@@ -100,6 +99,7 @@ type Loop struct {
 	toolParallelism int
 	hooks              ToolLoopHooks
 	onStream           func(model.StreamEvent)
+	onAudit            func(AuditEvent)
 	maxContextTokens   int
 	compactor          Compactor
 	transformContext   func(context.Context, []model.Message, int) []model.Message
@@ -150,6 +150,7 @@ func New(opts Options) *Loop {
 		toolParallelism:  toolParallelism,
 		hooks:            opts.Hooks,
 		onStream:         opts.OnStream,
+		onAudit:          opts.OnAudit,
 		maxContextTokens: opts.MaxContextTokens,
 		compactor:        compactor,
 		transformContext: opts.TransformContext,