fix(i18n): code-ize health signals and drop silent zh locale defaults

[orangeCatDeveloper]

Summary

Two locale gaps from a repo-wide sweep, neither blocked on the architecture-policy work, so they ship first.

Health signals. packages/core/src/health.ts emitted zh product copy from the producer, and the English presenter reverse-mapped it by exact string match — any wording edit silently broke English rendering, and the runtime-probe detail was re-parsed out of a formatted zh string with regexes. Signals now carry a closed HealthSignalMessageCode union plus structured HealthSignalDetail variants; both locales map codes in the presenter catalog, the string anchors and regex parsing are deleted, and the producer is locale-free. Capability diagnostics use locale-specific fallback copy instead of leaking raw text. Connection-test failure classes are projected as a closed structured detail and mapped on both the Health and connection-detail surfaces; legacy diagnostics also degrade to locale-specific fallback copy. The runtime "运行态" label suffix moves from producer to presenter.

Silent zh defaults. The ui stream/projection seams defaulted locale to 'zh'; every production caller already passes the real locale, so the defaults existed only for tests and left a wrong-locale seam. locale is now required; tests pin zh via local wrappers. tool-format.ts also loses three inline locale === 'en' ? ternaries in favor of catalog entries.

Refs #2672

Verification

packages/ui suite:                      331 pass / 0 fail
core health tests:                       9 pass
desktop health-center-copy tests:        7 pass
desktop typecheck:                       4 tsconfigs pass
renderer architecture check:             pass
repo format:check:                        pass

The bilingual assertions cover message codes, structured runtime-probe details, capability fallback copy, connection-test failure classes on both Settings surfaces, and localized runtime labels. Unsupported app and storage health fixtures were removed instead of assigning them capability-only message codes.

Known remainder: Permission Center still applies its pre-existing CJK-content fallback to capability reasons; removing that sniff is outside this PR.

The app was not launched for manual acceptance.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code — initial analysis, implementation, and tests. OpenCode — review assessment, follow-up implementation, tests, and this description update. Each commit carries its corresponding Generated-by trailer.

Checklist

• Tests cover the change and fail without it

[Astro-Han]

The shape is right. The producer emits codes, the existing UiCatalog maps them, Record<HealthSignalMessageCode, string> makes a missing entry a compile error, and the never checks pin detail exhaustiveness. The reverse-mapping it deletes was genuinely fragile: matching signal.message === '不是工作区的默认模型来源。' meant any wording edit in health.ts silently broke English. And I checked the "code without copy leaves a blank" worry, it is not reachable, both maps are total by type and nothing persists a HealthSignal.

[P2] The zh health center now prints raw English bot diagnostics

Two lines apart in the same switch:

// signalDetailZh
return capabilityReasonsZh[detail.reason] ?? detail.reason;
// signalDetailEn
return capabilityReasonsEn[detail.reason] ?? 'See the corresponding settings page for details.';

The zh side passes the unknown reason through verbatim. Bot reasons are English: settings-ipc-helpers.ts:235 produces ${label} requires a Bot Token. and ${label} rejected the Bot Token., which reach capabilityDetail unchanged through readinessReason and runtimeProbeFromBotReadiness. So configure a bot with a bad token, test it, open Settings and Health in Chinese, and an English sentence is what you get.

On main the zh side had a fallback for exactly this: /[㐀-鿿]/.test(raw) ? raw : '状态详情请见对应设置页。'. So a PR whose purpose is removing locale leakage introduces the mirror leak. The comment above that line says unknown reasons "are today's zh snapshot diagnostics", and the new test only pins the zh-text case, which is why it went unnoticed.

Fix is to mirror the en branch, plus a test with an English unknown reason.

[P2] last_test_message puts a machine token on the user-visible surface

runtime-host-connections-ipc-main.ts:429 sends lastTestMessage: connection.lastTest.errorClass, and errorClass is the closed six-value union in connection-effects.ts:69. So the string the user sees is literally auth. The type comments call it raw producer text rendered verbatim by design, but it is an enum, which is the thing this PR code-izes everywhere else. zh is unchanged from main; en regresses from the fallback sentence to the bare token. There is already a seam for this exact field, connectionLastTestMessageDisplay(message, locale) in provider-panel-shared.ts:94.

[P3] Three smaller ones

capabilityReasonsZh and capabilityReasonsEn carry four keys each (disabled, missing platform credentials, macOS TCC only, and the Apple Events one) that capability-snapshot.ts never emits. Main had four dead mappings in the producer; this moves them faithfully and doubles them.

permission-center-page.tsx:705 still uses the /[㐀-鿿]/u CJK sniff on the same capability.*.reason field this PR just stopped sniffing. Not a regression, both predate this, but it means an English user sees the bot's English message in the Permission Center and the fallback sentence in Health, for one field. Worth naming as a known remainder given the PR's stated obligation.

settings-pages.stories.tsx:600 maps a storage-scope signal to capability_ok, so the story renders capability copy for a SQLite row. Root cause is that HealthSignalMessageCode has no code for the app and storage scopes those fixtures use, and no producer emits them.

Next step

Both P2s are one catalog entry each. P3-1 is a free deletion in the same file.

This is a copy change with no screenshots, so it needs manual acceptance in Settings and Health, both locales: a connection in each state, the runtime row with a successful and a failed send, the runtime label suffix that moved from producer to presenter, and a bot capability after a failed credential test, which is the P2 reproduction.

Evidence boundary: read at cfe5ba2 against base b1ec289, no tests, typecheck or build, and the app was not launched. Both P2s are traced through source but not observed at runtime. The claim that no production caller relied on the removed zh defaults rests on a repo-wide grep plus the compiler, not a typecheck run.

AI-assisted review: drafted with Maka.

[orangeCatDeveloper]

@Astro-Han Comments are addressed.