fix(homecore): harden runtime and publish truthful capabilities

[ruvnet]

Summary

• connect state and service events to the shared bus and bound WebSocket delivery
• fail closed on missing tokens, remove the UI dev token, opt in to synthetic entities, and add graceful shutdown
• replace success-shaped service stubs with real state mutation and expose authenticated local intent handling
• recover recorder delivery, enable ruvector indexing, load automation YAML, and atomically persist migrated entity registries
• remove inactive plugin/HAP runtime claims and publish an exact implemented/deferred capability matrix
• clean adjacent Clippy findings in automation, recorder, registry, and API paths

Validation

• no-default HomeCore suite across 9 crates: passed
• homecore-server --all-features: 21 passed
• homecore-plugins --features wasmtime: 32 passed
• homecore-recorder --features ruvector: 31 passed
• Clippy (default runtime, all targets, warnings denied): passed
• HOMECORE UI: 41 passed
• optimized homecore-server release build: passed
• git diff --check: passed

Tooling notes

• all-feature Clippy is blocked by an installed Clippy/rustc mismatch (Clippy 1.89 vs rustc/cargo 1.91; Wasmtime 42 requires 1.91). All-feature compilation and tests pass under rustc 1.91.
• the verification skill's npm command references unavailable package Codex-flow@alpha (npm 404); native Rust/UI validation above was used instead.

Scope

This is an alpha hardening pass, not a claim of full Home Assistant parity. Deferred surfaces are explicit in v2/docs/homecore-capabilities.md.