feat: purge legacy agent hosts and land vault Chrome extension path

Retire ACP/Hermes/OpenCode surfaces and rename hermes_tools to
mnote_agent_tools so Page AI stays on Pi Lab only. Add Chrome vault
extension + extension token route, pre-release purge design, and soft-retire
legacy smokes for the small-group production cut.

scripts/task126-rust-web-ai-bridge-structured-write-smoke.js

@@ -1,6 +1,12 @@
 #!/usr/bin/env node
 "use strict";
 
+/**
+ * 历史：曾验证 /api/hermes/bridge structured write 合同。
+ * Wave 10：Hermes bridge 已删除；改为负向门禁（404），主链用 /api/mnote/tools + Pi Lab。
+ * tools manifest 可能需登录（401 仍表示路由挂载，区别于 404）。
+ */
+
 const assert = require("node:assert");
 
 const BASE_URL = (process.env.MNOTE_UI_BASE_URL || "http://127.0.0.1:3000").replace(/\/$/, "");
@@ -16,19 +22,43 @@ async function main() {
       context: { documentId: "doc_1", workspaceId: "ws_demo" },
     }),
   });
-  const payload = await response.json();
-  assert.equal(response.status, 200, `/api/hermes/bridge 请求失败: ${response.status}`);
-  assert.equal(response.headers.get("x-mnote-ai-bridge-owner"), "rust-web-hermes");
-  assert.equal(payload.canonicalRoute, "/api/hermes/bridge");
-  assert.match(payload.eventStreamEndpoint || "", /\/api\/hermes\/events\//);
-  assert.equal(payload.contract.structuredWriteOwner, "rust-web-hermes");
-  assert.deepEqual(payload.structuredWrite.allowedCommands, [
-    "page.body.save",
-    "tree.node.create",
-    "kernel.edge.attach",
-  ]);
+  const text = await response.text();
+  assert.equal(
+    response.status,
+    404,
+    `legacy /api/hermes/bridge 应已删除，实际 ${response.status}: ${text.slice(0, 300)}`,
+  );
 
-  console.log(JSON.stringify({ ok: true, bridgeOwner: "rust-web-hermes" }, null, 2));
+  const tools = await fetch(`${BASE_URL}/api/mnote/tools/manifest`);
+  const toolsText = await tools.text();
+  assert.notEqual(
+    tools.status,
+    404,
+    `/api/mnote/tools/manifest 路由应挂载（200 或 401），实际 ${tools.status}`,
+  );
+  // 未登录时 401；已登录时 200 且含 schema
+  if (tools.status === 200) {
+    assert.ok(
+      toolsText.includes("mnote.agent_tool_manifest.v1"),
+      "tools manifest 应使用 mnote.agent_tool_manifest.v1",
+    );
+  }
+
+  console.log(
+    JSON.stringify(
+      {
+        ok: true,
+        legacyHermesBridge: { status: 404 },
+        agentTools: {
+          status: tools.status,
+          mounted: true,
+          schemaOk: tools.status === 200 ? toolsText.includes("mnote.agent_tool_manifest.v1") : null,
+        },
+      },
+      null,
+      2,
+    ),
+  );
 }
 
 main().catch((error) => {