fix(ci): restore boundary and Rust checks

[limityan]

Summary

• Restore the sse-stream 0.2.3 API used by the MCP streamable HTTP transport.
• Record review-platform ownership of its optional sha2 and windows dependencies, with a self-test that prevents rule drift.
• Run the complete core-boundary test suite in CI while preserving the repository's generated-lockfile workflow.

Root cause

Two main-branch changes drifted independently: the review-platform feature added optional dependencies without updating the ownership table, and a lint cleanup renamed from_byte_stream to an API that does not exist in sse-stream 0.2.3. Core-boundary self-tests were not part of CI, and the workspace compilation path exposed the transport API regression.

The first PR revision incorrectly added --locked to the initial CI compilation command. Cargo.lock is intentionally ignored in this repository, so a fresh checkout could not create it. The compilation command now generates the lockfile; the existing later cargo test --locked step consumes that generated file.

Verification

• node --test scripts/check-core-boundaries.test.mjs
• node scripts/check-core-boundaries.mjs
• pnpm run check:github-config
• pnpm run check:repo-hygiene
• cargo +nightly check --locked -p bitfun-services-integrations --no-default-features --features mcp
• cargo +nightly check --locked --workspace --exclude bitfun-cli
• git diff --check gcwing/main...HEAD

The full workspace check retains existing Windows unsafe-operation warnings but introduces no new warnings.

Independent review

Independent CI/backend review found and fixed two issues: CI initially ran only the default boundary command instead of its self-test, and the first revision made a fresh-checkout compilation lockfile-strict despite the ignored lockfile policy. The final local recheck reported no remaining P0/P1/P2 findings.