refactor(runtime): extract bots and shared network packages

[sunheyi6]

Summary

Bot delivery currently pulls IM SDKs into every runtime consumer. Extracting bots while keeping a runtime re-export would retain that dependency and, if bots imported runtime, introduce a cycle.

• Extract bridges and their tests into @maka/bots; move shared proxy transports into @maka/network. Neither package depends on runtime. Desktop connects bot events to Session execution through the existing callbacks.
• Migrate consumers, workspace builds, CI selection, and license inventories. Runtime and CLI no longer include the Slack, Feishu, or WeCom SDKs; ws remains for OpenAI Responses WebSocket transport.

Fixes #3910.

Compatibility

This intentionally revises the issue's old-entry compatibility requirement: remove @maka/runtime/bots and the migrated runtime network exports instead of keeping a re-export. These are private workspace packages, and all known consumers are migrated together. Import bots from @maka/bots and transports from @maka/network/*. No session or persisted-data migration is required.

Verification

• Clean npm ci --ignore-scripts, npm run build:test, full npm run build, and npm run typecheck passed on the PR worktree based on ac59b47b7.
• Full lint/format checks, ASF headers, Desktop/CLI license checks, and git diff --check passed.
• 139 bot/network/model-transport tests and 72 CI/package tests passed. Production dependency closure checks confirmed the SDK removal.
• Earlier extended Host validation: 152 passed, 5 failed, 3 skipped. All five failures (implementation-child completion, SQLite cleanup, and three OAuth publication cases) also reproduced in an isolated pre-change checkout at 5d24c3c59; they are not fixed here.
• Knip for Desktop/UI is not green: it reports unused files/exports and dependency/binary declarations. Those findings were not cleaned up in this extraction. Full workspace tests and Electron E2E were not run.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex implemented the extraction, migrated consumers/tests, ran validation, and drafted this PR. The commit includes a Generated-by trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally — the extended Host failures are disclosed above.

Does this PR entail a change in behavior?

• Yes — private package import paths and installation dependencies change as described above; Session behavior is unchanged.
• No

中文说明

概述

目前机器人投递模块使所有 runtime 使用方都带上 IM SDK。直接拆包但保留 runtime 转导出，仍会保留这条依赖；如果 bots 同时依赖 runtime，还会形成循环。

• 将机器人桥接实现及测试迁入 @maka/bots，将共享代理传输能力迁入 @maka/network。两个包均不依赖 runtime；Desktop 继续通过现有回调将机器人消息连接到 Session 执行。
• 同步调用方、工作区构建、CI 选择和许可证清单。Runtime 与 CLI 不再携带 Slack、飞书、企业微信 SDK；ws 仍用于 OpenAI Responses WebSocket 传输，因此保留。

解决 #3910。

兼容性

这里明确调整 issue 的旧入口兼容要求：删除 @maka/runtime/bots 及已迁移的 runtime 网络导出，不保留转导出。这些是私有工作区包，已知调用方均在本次统一迁移。机器人从 @maka/bots 导入，网络传输从 @maka/network/* 导入。不涉及 Session 或持久化数据迁移。

验证

• 在基于 ac59b47b7 的 PR 工作区完成干净的 npm ci --ignore-scripts，npm run build:test、完整 npm run build 和 npm run typecheck 均通过。
• 全仓 lint/格式检查、ASF 许可证头、Desktop/CLI 许可证检查及 git diff --check 均通过。
• 139 项机器人／网络／模型传输测试和 72 项 CI／打包测试通过。生产依赖树检查确认专用 SDK 已移除。
• 此前扩展 Host 验证为 152 项通过、5 项失败、3 项跳过。这 5 项失败涉及实现子任务结束、SQLite 清理及三个 OAuth 发布场景，在修改前的独立工作区 5d24c3c59 中也全部复现；本次不修改这些问题。
• Desktop/UI 的 Knip 检查未通过，报告了未使用文件／导出及依赖／命令声明问题。本次拆包没有顺带清理这些报告。未运行全部工作区测试或 Electron E2E。

AI 使用

生成式工具有实质贡献。OpenAI Codex 完成拆包、调用方和测试迁移、验证及 PR 草稿；提交包含 Generated-by 标记。

检查清单

• 测试覆盖本次改动，未实施改动时相关边界测试会失败。
• 不宣称全部相关测试通过：lint、格式和类型检查通过，扩展 Host 的失败已在上方披露。
• 行为变化：私有包的导入路径和安装依赖发生变化，Session 行为不变。