feat(creative): add on-demand skills and restore installer CI

[bobleer]

Summary

Creative mode now distinguishes creative file deliverables from changes to the running OpenBitFun client. It routes videos, decks, prototypes, web design, and interface polish to public creative skills fetched on demand, while retaining the existing MiniApp and client-customization owners.

The prompt documents skill entry points, sparse caching, licensing and runtime prerequisites, permission boundaries, output verification, and remote execution location. Creative mode descriptions are updated in English, Simplified Chinese, and Traditional Chinese, with prompt contract coverage for the new routing.

A separate installer fix restores clean CI dependency resolution: all zip 0.6 releases have been yanked, so the standalone installer now uses zip 9.0.3 with only Deflate support. It adapts the writer and fallible filename APIs and verifies both file-based and embedded extraction against a frozen ZIP generated by zip 0.6.6 (Stored, Deflated, UTF-8 paths, and filtering).

Type and Areas

Type: Feature and CI-blocking installer dependency fix

Areas: Built-in Agent content, Creative harness description and tests, Web UI locale resources, standalone installer ZIP support.

Motivation / Impact

Users can ask Creative mode for finished creative artifacts in addition to MiniApps and interface customization. Skills are fetched for the relevant task and are not bundled or installed into user skill directories. Existing product-owner delivery, permission, and remote-support boundaries remain explicit.

Verification

• pnpm run fmt:rs — passed for the changed Rust files.

• cargo test --locked -p openbitfun-agent-content --test prompt_catalog_contracts — passed, 9 tests.

• cargo test --locked -p openbitfun-core --no-default-features --features agent-runtime,git,tools-browser-web,tools-computer-use --lib agentic::agents:: — passed, 108 tests; existing unused-import/dead-code warnings remain in the narrow feature build.

• pnpm run i18n:audit — passed, 0 warnings.

• git diff --check — passed.

• GitHub API entry-path checks — all five referenced skill entries exist on their repositories' default branches (onetake, HyperFrames, huashu-design, Taste Skill, and Emil design engineering).

• cargo check --manifest-path OpenBitFun-Installer/src-tauri/Cargo.toml — passed on macOS with a fresh standalone dependency resolution.

• cargo test --manifest-path OpenBitFun-Installer/src-tauri/Cargo.toml --lib installer::commands::tests — passed, 6 tests.

• cargo test --manifest-path OpenBitFun-Installer/src-tauri/Cargo.toml --lib installer::extract::tests — passed, 1 legacy-payload compatibility test through both extraction entry points.

• node --test OpenBitFun-Installer/scripts/build-installer.test.cjs scripts/data-tools-tauri-build.test.mjs — 17 passed, 1 platform skip.

• pnpm run check:core-boundaries and pnpm run check:repo-hygiene — passed.

• GitHub CI run 38860892137 — successful on commit 21e651f4293542fbc435f4f840703f37e0b64a3a; together with Repository Object Sizes, 11 checks succeeded and 2 non-applicable packaging checks were skipped.

Reviewer Notes

AI-assisted; testing level: lightly tested (focused automated tests and locale audit). No live creative rendering or visual UI verification was performed. The Agent test suite includes remote-workspace prompt fixtures; live Remote Workspace, Remote Control, Peer Device Mode, and Detached Dispatch scenarios were not exercised. No persisted configuration shape, transport protocol, or tool allowlist changes are included. The ZIP dependency change is confined to the standalone installer; the main workspace lockfile is unchanged. A full Windows installer package was not built locally on macOS; Windows compilation is covered by CI.

The Windows Desktop library-test probe encountered the existing Tauri loader limitation (tauri-apps/tauri#13419) before Rust tests ran. The unchanged CI workflow explicitly tolerates only that signature. Windows main-workspace and installer compilation, CLI tests, and subsequent contract tests passed; no CI checks were disabled or weakened.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.