refactor: move local filesystem owner to services-core

[limityan]

Summary

• Move platform-neutral local filesystem operations, directory listing, tree/search, and the consolidated filesystem service facade into bitfun-services-core::filesystem.
• Keep bitfun-core filesystem paths as compatibility facades, with core::service::filesystem::FileSystemService limited to remote-workspace overlay, legacy BitFunError mapping, and old API compatibility.
• Add boundary checks and concise docs/AGENTS updates so future filesystem owner drift is caught early.

Behavior and compatibility

• Local filesystem behavior is intended to remain equivalent: the moved operations preserve the existing read/write, binary encoding, search, listing, editor-sync normalization, and hash behavior.
• Remote workspace routing remains in core through the existing remote connection hint and remote file-service lookup path.
• Existing core import paths remain available through re-export facades, avoiding call-site churn in this PR.

Risk review

• Main risk was partial extraction leaving duplicated local filesystem logic in core; this was corrected before submission by delegating local operations through bitfun-services-core::filesystem::FileSystemService.
• No product runtime, MiniApp IO, tool-result persistence, PathManager binding, or remote SSH runtime ownership is moved in this PR.
• No benchmark was run; the diff does not introduce additional local filesystem walks or IO passes, only a thin delegation/error-mapping boundary.

Verification

• cargo test -p bitfun-services-core filesystem -- --nocapture
• node scripts\\check-core-boundaries.mjs
• cargo check -p bitfun-core --features product-full
• cargo check -p bitfun-desktop (existing dead_code warning in clipboard_file_api.rs)
• cargo check -p bitfun-server
• git diff --check