feat: 完善 Agent 标准交互与安全运行时

- 接入 AG-UI 运行投影、Turn 时间线和审批隔离

- 增加 Agent Skill 冻结绑定与运行时消费闭环

- 增加受控工作区、内置工具和私有 Artifact 生命周期

easyflow-ui-admin/app/src/views/ai/agent-chat/index.vue

@@ -51,6 +51,7 @@ import {
 } from 'element-plus';
 
 import {
+  createAgentArtifactLoader,
   loadAgentChatDocument,
   loadAgentChatImage,
 } from '#/components/ai-chat/mediaApi';
@@ -91,6 +92,11 @@ const selectedAgentId = ref('');
 const currentSessionId = ref('');
 const composer = useAgentComposerDraft('FORMAL');
 const promptText = composer.text;
+const loadCurrentAgentArtifact = createAgentArtifactLoader(() => ({
+  agentId: selectedAgentId.value,
+  mode: 'FORMAL',
+  sessionId: currentSessionId.value,
+}));
 const promptInputRef = ref();
 const attachmentFileInputRef = ref<HTMLInputElement>();
 const composerDragActive = ref(false);
@@ -1043,11 +1049,11 @@ async function handleDeleteSession(session: AgentChatSessionView) {
 }
 
 async function handleApprove(payload: ChatTimelineToolApprovalPayload) {
-  approvalLoadingKey.value = payload.toolCallId || payload.requestId;
+  approvalLoadingKey.value = payload.toolCallId || payload.approvalId;
   ChatTimelineBuilder.markToolApproving(timelineItems.value, payload);
   persistCurrentRuntimeItems();
   try {
-    const res = await approveAgentRun(payload.requestId, payload.resumeToken);
+    const res = await approveAgentRun(payload.approvalId);
     if (res.errorCode !== 0) {
       throw new Error(res.message || '批准失败');
     }
@@ -1062,15 +1068,11 @@ async function handleApprove(payload: ChatTimelineToolApprovalPayload) {
 }
 
 async function handleReject(payload: ChatTimelineToolApprovalPayload) {
-  approvalLoadingKey.value = payload.toolCallId || payload.requestId;
+  approvalLoadingKey.value = payload.toolCallId || payload.approvalId;
   ChatTimelineBuilder.markToolApproving(timelineItems.value, payload);
   persistCurrentRuntimeItems();
   try {
-    const res = await rejectAgentRun(
-      payload.requestId,
-      payload.resumeToken,
-      '用户拒绝执行',
-    );
+    const res = await rejectAgentRun(payload.approvalId, '用户拒绝执行');
     if (res.errorCode !== 0) {
       throw new Error(res.message || '拒绝失败');
     }
@@ -1242,6 +1244,7 @@ onBeforeUnmount(() => {
         <ChatTimeline
           v-else
           :assistant-avatar="selectedAgent?.avatar || defaultAssistantAvatar"
+          :artifact-loader="loadCurrentAgentArtifact"
           :items="timelineItems"
           :document-loader="loadAgentChatDocument"
           :image-loader="loadAgentChatImage"