fix(web): address review findings on producer-declared context forms

- `catalogHistory` validated its durable read. `agent.session.events` is a
  JSONL/SQLite seed on resume or fork, and seed validation guarantees only a
  source object with a non-empty `kind`; a `skill-catalog` record with missing
  or wrongly shaped `entries` threw inside the step listener, failing every
  later turn of that session. It is now skipped as an unrecognizable record,
  the posture the replaced content digest had, with a regression test over six
  malformed shapes.
- The headless keyless smoke still filtered catalogs by the old plugin source,
  so the `built-bin-smoke` gate would not have found the catalog message.
- Entries record the published description unescaped. The pseudo-XML escaping
  belongs to the `<available_skills>` frame and is applied when rendering it,
  so a description containing `<` no longer reaches the card as `&lt;`.
  `escapeText` is injective, so republish semantics and the model-facing text
  are unchanged.
- Adjacent text blocks join with no separator, matching how provider adapters
  flatten them; the body no longer shows a line break the model never saw.
- Provenance fields are bounded like the text: an unknown producer may record
  an arbitrarily large value.
- Both readers are all-or-nothing, and the row's form marker reports what
  rendered rather than what was declared, so a partly unreadable record cannot
  present a confident but incomplete account.
- The catalog body consumes `update` as a replacement notice; the digest
  canonicalizes per entry as JSON, since every separator character is itself
  legal in a description.
- `core.md` documents the form axis with a `ContextForm` type-equiv block, and
  both projections assert the wiring they duplicate.

packages/client/runtime/tests/history-fold.spec.ts

@@ -19,12 +19,15 @@ describe('projectConversationHistory', () => {
         // A plugin source, because the client program does not see the host
         // packages that merge richer source kinds; those arms are pinned in
         // context-provenance.spec.ts.
-        source: { kind: 'plugin', plugin: 'dsh-tool-skill' },
+        source: { kind: 'plugin', plugin: 'dsh-tool-skill', form: 'catalog' },
       }),
     })
     const { contexts } = projectConversationHistory([{ event: injected }])
     expect(contexts[contexts.length - 1]?.nodes).toMatchObject([{
-      kind: 'context', seq: 0, provenance: { role: 'inject', label: 'dsh-tool-skill' },
+      kind: 'context',
+      seq: 0,
+      provenance: { role: 'inject', label: 'dsh-tool-skill' },
+      form: 'catalog',
     }])
   })
 

packages/client/runtime/tests/transcript-adapter.spec.ts

@@ -205,11 +205,14 @@ describe('TranscriptAdapter', () => {
       adapter.reset([
         at(0, { type: 'user/message', surfaceOp: 'append', data: createUserMessage({
           content: [{ type: 'text', text: '注入的上下文' }],
-          source: { kind: 'plugin', plugin: 'compact' },
+          source: { kind: 'plugin', plugin: 'compact', form: 'instructions' },
         }) }),
       ])
       expect(adapter.nodes()).toMatchObject([{
-        kind: 'context', seq: 0, provenance: { role: 'inject', label: 'compact' },
+        kind: 'context',
+        seq: 0,
+        provenance: { role: 'inject', label: 'compact' },
+        form: 'instructions',
       }])
     })