refactor(core): narrow no-default dependency profile

[limityan]

Summary

• Keep bitfun-core default behavior as the complete product-full runtime assembly while moving product/runtime-only direct dependencies behind existing feature gates.
• Extend scripts/check-core-boundaries.mjs into the H5 feature graph guard: no-default dependency profile, optional dependency feature owners, product-entry explicit core assembly, product-entry scan coverage, current core default guard, and owner crate default-light / explicit product-full feature-group checks.
• Update decomposition docs plus affected crate AGENTS guides without changing runtime logic, product behavior, Cargo manifests, release scripts, or build scripts.

Functional Boundary

• Product entries still use default-features = false with features = [product-full].
• bitfun-core default = [product-full] stays locked until a separate product matrix review.
• tool-packs, services-integrations, and product-domains keep default = []; their product-full features explicitly aggregate current owner feature groups.
• This is a feature/dependency boundary guard only, not runtime owner deep migration, per-product feature matrix, or build-benefit claim.

Validation

• Boundary checks: regular + self-test.
• Core checks: bitfun-core no-default, product-full, and ssh-remote combinations.
• Product checks: ACP, CLI, Desktop, Server.
• Owner checks/tests: tool-packs, services-integrations, and product-domains no-default/product-full profiles.
• Focused core tests: workspace session identity and core service-agent runtime owner.
• Diff checks: git diff --check and build/release script diff guard.