…#3566 2/N)

Adds ~110 method signatures to KernelApi covering subsystem accessors
(audit, agent_registry, approvals, event_bus, hands, memory, MCP,
templates, supervisor, …), '_ref' accessors that expose internal locks,
config / lifecycle hooks (reload_config, validate_config_for_reload,
shutdown), vault, inbox, auto-dream, full agent lifecycle (spawn / kill /
suspend / resume / compact / sessions / manifest / skills / mcp servers /
tool filters), messaging (send_message, send_message_ephemeral), hands
(activate / deactivate / pause / resume / reload / persist), MCP
connection ops (connect / disconnect / retry / reload / reconnect),
triggers + workflows + events, agent bindings, model-catalog access, and
'start_background_for_agent'.

The 'Arc<Self>'-receiver methods (connect_mcp_servers, retry_mcp_connection,
reload_mcp_servers, reconnect_mcp_server, start_background_for_agent) take
'self: Arc<Self>' on the trait so 'Arc<dyn KernelApi>' can dispatch to
them — call sites consume one strong ref per call (cloning the AppState
arc costs nothing).

The two generic-closure inherent methods are exposed as dyn-safe trait
methods:
  - update_budget_config takes '&dyn Fn(&mut BudgetConfig)'
  - model_catalog_update takes '&mut dyn FnMut(&mut ModelCatalog)' and
    returns (); callers needing the closure's return value capture it
    via '&mut Option<R>' from the surrounding scope (the AppState swap
    commit migrates the affected providers / registry / budget routes).

Bumps 'librefang-kernel' recursion_limit to 256 because the
'#[async_trait]' expansion nests pinned futures past the default 128
when the trait is this wide.

…erage (#3566 3/N)

Final structural change for #3566: 'AppState.kernel' is now
'Arc<dyn KernelApi>'. Routes interact with the kernel exclusively
through the trait; the concrete 'LibreFangKernel' is no longer reachable
from 'AppState'.

Trait widening
  - 'KernelApi' now extends 'KernelHandle' (the runtime-facing
    super-trait that bundles every role trait via #3746/#3744). This
    lets 'Arc<dyn KernelApi>' upcast to 'Arc<dyn KernelHandle>' (and to
    any individual role trait) for the runtime-call paths the dashboard
    uses (channel send, prompt store, task queue, approval gate, …) —
    no separate trait object needed.
  - Adds the kernel-inherent surface routes/WS/server/channel_bridge
    actually use that the role traits don't cover: subsystem accessors
    (audit, agent_registry, approvals, hands, memory, MCP, templates,
    supervisor, browser, media, tts, web_tools, …), '_ref' accessors,
    config/lifecycle ops (reload_config, validate_config_for_reload,
    shutdown), full agent lifecycle (spawn/kill/suspend/resume/compact/
    sessions/manifest/skills/MCP servers/tool filters), messaging
    (send_message + handle / blocks / sender_context / incognito /
    streaming variants), hand ops, MCP connect/disconnect/retry/reload/
    reconnect (Arc<Self> receivers), triggers + workflows + events,
    bindings, model-catalog access, vault, auto-dream, a2a tasks/agents,
    embedding/tts/web/browser/media engines, and 'data_dir' /
    'install_peer_registry_for_test' / 'set_self_handle' for
    integration tests.

Naming conflicts with role-trait methods are resolved by suffixing the
typed-arg variants on KernelApi:
  - 'spawn_agent_typed(AgentManifest) -> AgentId' (vs.
    'AgentControl::spawn_agent(&str, Option<&str>) -> (String, String)')
  - 'kill_agent_typed(AgentId)' (vs. 'AgentControl::kill_agent(&str)')
  - 'run_workflow_typed(WorkflowId, String) -> (WorkflowRunId, String)'
    (vs. 'WorkflowRunner::run_workflow(&str, &str) -> (String, String)')
  - 'publish_typed_event(Event) -> Vec<TriggerMatch>' (vs.
    'EventBus::publish_event(&str, Value) -> Result<(), _>')
Routes/tests are migrated to the typed names.

Generic-closure inherent methods become dyn-safe trait methods:
  - 'update_budget_config(&dyn Fn(&mut BudgetConfig))' (callers wrap as
    '&|b| { ... }')
  - 'model_catalog_update(&mut dyn FnMut(&mut ModelCatalog))' returning
    '()'; the providers/registry/server callers that needed the
    closure's return value now capture it via '&mut Option<R>' from the
    surrounding scope.

Receiver mechanics: the seven Arc<Self>-receiver methods
('connect_mcp_servers', 'disconnect_mcp_server' [&self], 'retry_/reconnect_/
reload_mcp_servers', 'send_message_streaming_with_*',
'start_background_for_agent', 'spawn_key_validation',
'auto_dream_trigger_manual', 'probe_local_provider', 'set_self_handle')
take 'self: Arc<Self>' on the trait. Call sites consume one strong ref
per call ('state.kernel.clone().method(...)') — Arc clones are cheap.

channel_bridge / server.rs migration:
  - 'KernelBridgeAdapter' / 'start_channel_bridge' /
    'start_channel_bridge_with_config' now take 'Arc<dyn KernelApi>'.
  - 'server::build_router' still takes 'Arc<LibreFangKernel>' (the
    daemon-side caller has the concrete kernel); it implicitly coerces
    to 'Arc<dyn KernelApi>' at the AppState struct literal.
  - 'as Arc<dyn KernelHandle>' explicit casts at 7 call sites are
    replaced by implicit upcast via the type annotation
    ('let kh: Arc<dyn KernelHandle> = state.kernel.clone();') — works
    because of the new supertrait.

Recursion limit on librefang-kernel is bumped to 256 ('lib.rs') because
the '#[async_trait]' expansion across this many methods pushes the
default 128-step layout pass over the edge.

Verification
  cargo check --workspace --all-targets  passes locally
  (next commits: clippy zero-warnings, then 'cargo test -p librefang-api').

'register_trigger_with_target' (8 args) and 'send_message_with_incognito'
(8 args) mirror the kernel-inherent signatures verbatim. Splitting the
trait method into a builder would diverge the trait surface from the
inherent surface and break the 'trait is a thin facade' invariant. The
inherent kernel methods are themselves over the threshold; clippy is
silenced at the file level rather than per-method to keep the trait body
uncluttered.