Improve architecture guardrails for FluentFrame

[Kingson4Wu]

Harness Assessment

• WorkOrder: 1788114600000-fluent-frame-harness-auto
• Strategy: health-first
• Initial architecture assessment: 93, below target 95
• Final architecture assessment: 93; remaining findings are generic architecture slice prompts, with .codegraph absent from guard files. Architecture subtask limit was reached after three bounded rounds.
• Stop condition: not fully reached because score remains below 95; no confirmed bug/security issue was found in checked signals.

Selected Subtasks

• Architecture round 1: consolidated duplicate extension background message object guards behind backgroundMessages.ts.
• Architecture round 2: centralized identical shared protocol object guards in protocolScalars.ts, preserving the stricter resultValidation.ts array rejection behavior.
• Architecture round 3: added a test-only guard that keeps native-host executable request routing behind hostRouter.

Skipped Subtasks

• Bug fix: skipped because no confirmed production-risk bug was identified by assessment, worker inspection, or verification.
• Security maintenance: skipped for code changes because pnpm audit --audit-level high found no known high vulnerabilities and no reachable security issue was confirmed.
• Test coverage: skipped for metric-target work because there is no unified coverage script; added only meaningful architecture tests tied to real boundary risks.

Changes

• Added apps/extension/src/backgroundMessages.ts as the single extension-owned background message object guard.
• Updated background native-message and streaming listeners to reuse that guard.
• Added isProtocolObject in packages/shared/src/protocolScalars.ts and reused it in host protocol parsers.
• Added architecture boundary tests for extension message guard ownership, shared protocol object guard ownership, and the native-host router seam.

Verification

• node --test scripts/tests/architecture-boundaries.test.mjs passed, 27/27.
• pnpm run typecheck passed across shared, extension, and native-host workspaces.
• pnpm test passed: shared 42/42, extension 140/140, native-host 132/132, script tests 45/45.
• pnpm audit --audit-level high passed: no known vulnerabilities found.
• git diff --check passed.

Remaining Risk

• The assessment score remains 93 despite the completed slices; the remaining assessment output is generic and the configured architecture subtask maximum has been reached.
• Broader route-table refactors in parseHostRequest / parseHostResponse are deferred because they carry higher behavior risk than this harness run allows.