A multi-crate scan surfaced one high-severity auth bypass plus several correctness and hardening defects; each was adversarially re-verified against source before fixing.

channels/bridge.rs — the multimodal (image/voice/video) dispatch path authorized `message.sender.platform_id`, which for group messages is the group/chat JID, not the individual sender. An unauthorized group member could bypass the RBAC allowlist by sending media instead of text. The media path also skipped the group_policy / dm_policy / rate-limit gating the text path enforces, letting media bypass a `mention_only`/`ignore` group or DM `dm_policy=ignore` and evade per-user throttling. Both paths now key on `sender_user_id(message)` and the debounced media branch runs the same gating helper as the text path (gated at the single ungated entry point so rate-limit tokens are not double-counted).

skills/verify.rs, runtime/prompt_builder.rs, kernel/prompt_context.rs — the prompt-injection scanner ran Aho-Corasick over raw text, so a zero-width or bidi code point spliced into a literal (`ignore<ZWSP>previous instructions`) evaded every Critical pattern while invisible chars were only a non-blocking Warning and were never stripped before reaching the prompt. The scanner now also scans an invisible-stripped and a separator-restored variant (dedup shared across passes), `sanitize_for_prompt` drops invisible/format code points, and the previously-unsanitized `collect_prompt_context` content slot strips them too.

api/routes/skills/clawhub.rs — `clawhub_install` and `clawhub_cn_install` joined `req.hand` into a filesystem path with no validation, unlike the sibling `install_skill`. A `../`-bearing hand id escaped the hands directory. Both now run `validate_skill_identifier` before the join.

llm-drivers/gemini.rs — the streaming usage path dropped `cache_read_input_tokens`, over-charging cached Gemini prompt tokens at the full input rate. It now mirrors the non-streaming paths and captures `cached_content_token_count`.

cli/mcp.rs — the MCP stdio server collapsed a malformed JSON body into EOF and returned `Err` on oversized frames, killing the whole session on one bad message. `read_message` now returns a `Frame` enum distinguishing true EOF from recoverable protocol errors; the run loop replies with JSON-RPC -32700 and continues.

Verification: cargo check + clippy (-D warnings) green across all seven touched crates with --all-targets; new regression tests added for each fix (channels principal/gate parity, skills both bypass shapes, prompt_builder strip, gemini streaming cache tokens, mcp malformed-then-valid frame recovery) and the affected crates' unit + integration suites pass.

Addresses findings from a high-effort review of the prior commit, all in code that commit introduced.

channels/bridge.rs:
- The media gate resolved channel-level overrides only; the text path resolves agent-level overrides (agent.toml) with channel-level as fallback. Media now resolves the target agent and merges per-agent overrides identically, so per-agent group/DM policy and rate limits apply to media. output_format and threading now also follow the merged overrides.
- The gate omitted the reply-intent precheck the text path runs for group_policy=all, so a stray captioned media message got a reply where the same text would have stayed silent. The precheck is now replicated.
- Record-on-skip used text_content(), which returns None for Image/Voice/Video, so captions were never recorded into group_history despite the comment. A new extracted_user_text() helper returns the real caption (never the [Photo: url] placeholder) and is used for both record-on-skip and precheck classification.

skills/verify.rs (+ runtime/prompt_builder.rs, runtime/injection_guard.rs, kernel/prompt_context.rs):
- INVISIBLE_CHARS omitted several commonly-abused code points (soft hyphen, combining grapheme joiner, arabic letter mark, hangul/khmer fillers, mongolian vowel separator, invisible math operators, variation selectors, …). Added them and synced all four duplicated copies.
- A combined obfuscation payload (one zero-width char splitting a word AND another replacing a separator) defeated the stripped and spaced passes. Added a whitespace-invariant compact pass that matches multi-word threat phrases against the invisible-and-whitespace-stripped text. The compact pass runs ONLY when invisible chars are present, so benign line-broken prose (which has none) cannot be falsely flagged by whitespace gluing.

cli/mcp.rs:
- A malformed Content-Length value (or headers with no Content-Length) collapsed to length 0 and was reported as Frame::Eof, killing the session — the exact malformed-frame-kills-session class the prior commit set out to fix. read_message now tracks whether any header was seen and whether Content-Length parsed; a malformed/missing length on a framed message returns Frame::ProtocolError (reply -32700, continue) while only a genuine header-less EOF returns Frame::Eof.

Verification: cargo clippy --all-targets -D warnings green across channels/skills/runtime/kernel/cli; lib suites pass (channels 496, skills 212, runtime prompt_builder/injection_guard, kernel prompt_context); new regression tests added for extracted_user_text, the combined/expanded invisible-char attacks with a benign-prose false-positive guard, and the malformed/missing Content-Length frame recovery.