perf(build): narrow Core defaults and ACP role assembly

[limityan]

Summary

• make bitfun-core default features empty and attach base64, futures, regex, and tokio-util to the exact runtime owners that consume them
• split bitfun-acp into additive client and server roles while preserving the compatibility default as client + server
• make Desktop select ACP client-only and CLI select both roles explicitly
• extend the existing Core boundary checker so normal, target-specific, dev, build, optional, and default-feature ACP dependency edges cannot silently widen a product role
• update the owning architecture, module verification, and compile-performance documentation

Architecture and compatibility

• product-full remains the explicit full-product assembly and its three-platform dependency closure is unchanged.
• ACP client keeps Agent Runtime and concrete SSH support. ACP server keeps its reviewed document, subscription, LSP, external-source, and tool owners without pulling SSH back in.
• This does not migrate runtime ownership, public protocol DTOs, or host lifecycle responsibilities.
• Debug-log keeps the workspace-local .bitfun/debug.log override when workspace-runtime is enabled; its standalone owner now uses the configured path and compiles independently.
• Breaking compile-time contract: bitfun-core no longer enables product-full by default. Repository product consumers already select explicit owners. External path/git consumers that relied on the old implicit full surface must enable product-full or select the owners they use.

Dependency impact

Counts are deduplicated normal/build package instances for Windows x86_64, macOS aarch64, and Linux x86_64.

Closure	Windows	macOS	Linux
Core default	570 -> 93	557 -> 82	601 -> 81
Core product-full	570 -> 570	557 -> 557	601 -> 601
ACP default	587 -> 587	572 -> 572	592 -> 592
ACP client-only	397	390	391
ACP server-only	533	518	539
Desktop	790 -> 790	805 -> 805	887 -> 887
CLI	643 -> 643	642 -> 642	665 -> 665

Desktop's package set is unchanged, but its ACP build no longer compiles 4,211 lines of server/runtime source. This PR does not claim a measured Desktop wall-clock improvement.

• Cargo.lock: byte-for-byte unchanged; no packages added, upgraded, or removed
• GitHub workflows: unchanged; no jobs or checks added

Verification

• node --test scripts/check-core-boundaries.test.mjs (92/92)
• pnpm run check:core-boundaries
• cargo metadata --locked --offline --no-deps --format-version 1
• Core checks with no features, agent-runtime, debug-log, dispatch-store, and product-full
• ACP tests: client-only 47/47, server-only 65/65, compatibility default 112/112
• cargo check --locked --offline -p bitfun-cli --bins
• cargo check --locked --offline -p bitfun-desktop
• git diff --check

Three independent adversarial review passes covered architecture and upstream rebase compatibility, dependency/feature closure, and test/CI scope. The final rebased commit has no unresolved P0-P3 findings.