feat(ce): enforce edition boundaries and harden local readiness

[Luhaozhu]

Summary / 概述

This maintainer CE synchronization combines the complete public-facing changes
from upstream commits 286fcae3, a97af08d, 561f0159, and 9a6264a7.

What changed

• Enforce a physical CE/EE boundary. The generated CE tree now excludes
  enterprise-only licensing, API key, organization/team/role, datasource,
  skill-distillation, and provider-specific implementation modules instead of
  shipping them behind runtime checks.
• Introduce CE-owned edition interfaces for accounts, permissions, database
  models, repositories, projects, MySpace, sites, agents, external knowledge,
  API schemas, and frontend contracts. This keeps the personal product flows
  complete without importing enterprise packages.
• Keep the ontology control plane in CE and ensure an administrator-disabled
  domain pack is treated as an effective opt-out in chat context construction.
• Bootstrap the credential-free automation, skill-manager, and sites
  plugins on the first CE startup. A persistent database marker makes the
  bootstrap idempotent and preserves a user's later uninstall choice.
• Harden no-Docker and desktop readiness. Local MCP servers bind to loopback,
  startup waits for all registered ports, verifies the three default-plugin
  tool contracts, and fails readiness when the advertised toolset is missing.
• Prevent packaged Windows CE desktop startup from exiting when redirected
  Python logs use a legacy code page. The launcher now forces UTF-8, while CLI
  status output safely degrades without changing plugin or template outcomes.
• Prune stale global built-in MCP rows when their runtime is absent from the
  current edition, while preserving plugin-owned and user-owned MCP entries.
• Update the bilingual deployment and edition documentation, desktop CE
  release staging contracts, and the English and Chinese README capability
  posters.

Why

CE previously relied on runtime visibility checks in several areas while still
carrying enterprise implementation code in the generated source tree. That
made the open-source boundary harder to audit and left room for schema, route,
catalog, and frontend contracts to drift between editions.

The local startup path also treated MCP sidecars as best-effort and default
plugins as an onboarding choice. A desktop process could therefore pass its
health check while one of the capabilities presented as available was missing.
Persisted databases could additionally retain removed commercial MCP rows after
an edition upgrade.

The packaged Windows launcher redirects backend output to a log file. On
systems where Python selected GBK for that redirected stream, a status symbol
raised UnicodeEncodeError inside the plugin bootstrap transaction and turned
a successful installation into a fatal readiness failure.

User and maintainer impact

• CE contains only the code and data contracts required for its supported
  feature set, with explicit extension interfaces where editions differ.
• Fresh browser, no-Docker, and desktop installations provide scheduled tasks,
  skill management, and site publication without a separate marketplace step.
• A healthy local backend now means the default plugin MCP tools are actually
  reachable, and local control-plane ports aren't exposed to the LAN.
• Packaged Windows CE desktop builds start reliably with redirected logs across
  system code pages, and the resulting service log remains valid UTF-8.
• CE upgrades remove stale unavailable built-ins without overwriting user or
  plugin configuration.
• Administrators can disable a domain ontology pack and have that policy
  consistently honored by the chat runtime.

Validation

• HUGAGENT_RELEASE_BUILD=1 python scripts/build_ce.py --import-check --pytest-check --frontend-check
  • required-runtime and forbidden-artifact gates passed
  • binary SHA-256 allowlist and brand/path scans passed
  • CE import, OpenAPI, and ORM contracts passed
  • backend test collection and frontend production build passed
• Derived CE regression suite: 79 passed, 2 skipped
• Source and derived default-plugin, local-sidecar, and local-memory regressions:
  17 passed
• node --test desktop/scripts/ce-payload.test.mjs: 6 passed
• Windows packaged-runtime regression: CE reached /health with UTF-8
  environment overrides deliberately removed; the redirected log decoded as
  UTF-8 and contained the completed default-plugin bootstrap status
• Changed Python files pass Black checks; desktop Rust passes cargo fmt
• git diff --check passed
• Both new poster assets were visually reviewed and metadata/sensitive-string
  screened before their hashes were added to the CE binary allowlist

Related issue / 关联 Issue

N/A

Type of change / 变更类型

• 📖 Documentation (document/**, README*.md)
• 🧩 Example / sample (examples/**)
• 🔧 Repo meta (CI, templates, .github/**)
• Other (please describe / 请说明): Maintainer synchronization of generated CE runtime, frontend, desktop, and test code.

Checklist / 检查项

• My change only touches non-generated paths (docs / examples / repo meta). 仅改动非生成路径。
• Links and code snippets were verified. 链接与代码片段已验证。
• For bilingual docs, I updated both document/en/** and document/zh-CN/** where applicable. 双语文档已同步更新（如适用）。
• I read CONTRIBUTING.md. 我已阅读贡献指南。