fix(agent): unify CLI probe pipeline with classified failures and adaptive slow-probe recheck

[kaizhou-lab]

Closes #675

Summary

• Classify version-probe failures (cli_probe.rs): command_not_found / version_probe_failed (exit != 0 — corrupted install, fails fast) / version_probe_timeout (slow load — NOT proof of corruption), with the measured --version duration reported on success and carried in every failure message.
• Timeout no longer condemns an agent to Missing: the row stays installed, surfaces as Unchecked (which the generated-assistant reconcile already materializes, so the agent stays visible in the assistant list), and is queued for a background recheck.
• Background slow-probe recheck (registry.rs): after hydrate(), pending agents are re-probed sequentially with a 30s budget off the readiness path; the outcome is persisted as a startup-kind snapshot with the measured latency.
• Adaptive inline skip: an agent whose persisted startup snapshot shows a slow probe (timeout, or latency > 2s) skips the inline 5s probe entirely on the next hydrate — each machine pays the 5s lesson at most once per agent, and backend readiness is never dragged by known-slow CLIs. No static slow-list: "slow" is a property of package × machine, learned from measured history.
• A failing --version (exit != 0) now means corrupted-install: installed + Offline with version_probe_failed and the stderr head, instead of Missing ("not installed") which sent users down the wrong path.
• Manual test connection is the self-rescue path: no longer short-circuited by a stale available=false verdict, always reaches its real probe, and a success restores the agent to online. reload_one no longer re-runs --version on every cache refresh (it double-probed every manual check and stomped fresher manual snapshots with a startup-kind verdict).
• Builtin claude/codex manual check now runs PATH + --version (was PATH-only, so a corrupted install showed online). They do not speak ACP, so no session/new-style handshake is added — --version integrity is their deep check.
• Commandless-builtin fallback unified: the PATH-only cli_detect side door is removed; the fallback branch uses the same classified probe engine.
• Unchanged by design: ACP-agent deep check (real initialize handshake with classified command_not_found / acp_init_failed / auth_required), Aion CLI provider-readiness check (no_provider), and the skip_version_probe lock flag (still only sigit; pi keeps its integrity probe).
• UI guidance strings added for the new error codes. No frontend changes required.

Background

Sentry feedback ELECTRON-3PN ("公司内网中pi链接不上"): pi-acp's prerequisite pi CLI (~19,300 files installed) takes 5.6–6.8s to cold-load --version on the affected Windows machine, so the fixed 5s probe always timed out and AionUi treated a correctly-installed agent as not installed, with no diagnosable error anywhere. The same user's db shows Claude Code manual-check latency at 3753ms — one AV scan away from the same cliff. See #675 for the full analysis and code map.

Verification

• cargo nextest run --workspace: 7431 passed, 0 failed (18 skipped)
• cargo clippy --workspace --all-targets: clean
• just migration-check: passed (no migrations touched)
• New tests: probe classification (4), adaptive pipeline incl. deterministic skip-proof via execution marker (4), manual-check semantics incl. restoration (5)