refactor(external-sources): simplify integration controls

[limityan]

Summary

• Remove the parallel application connection model, batch confirmation flow, task-specific action-required events, and the related protocol expansion.
• Keep the existing external-source policy and owner-specific Tool, Agent, MCP, and Hook controls as the single source of truth.
• Reduce the change from an additional product layer to a focused simplification: 1,074 additions and 11,715 deletions.

Product experience

• Web settings show one compact row per discovered app: name, switch, and an attention icon only when action is required.
• The attention icon opens the matching owner control. If the master switch is off, activating an app switch opens Advanced settings and focuses the master switch.
• Empty app and Hook states remain explicit. Hooks and Advanced settings use clear disclosure controls instead of looking like static labels.
• The overview hides risk labels, recommendations, capability counts, technical identifiers, and internal status details.
• TUI keeps one familiar /extensions entry for status, enable, disable, and refresh. Safe Mode guidance appears only while Safe Mode is active.
• Detailed decisions remain under the established /tools, /agent, /mcp, and /hooks commands. There is no /extensions review command or new command family.

Compatibility and boundaries

• App Server remains at protocol v3 with minimum v2; Shared Runtime IPC remains at v17.
• Existing Desktop, Peer, Remote, source-policy, and owner permission guards remain in place.
• A retired automatic-enable default is reverted only once. Existing policy deviations and explicit application choices are preserved, and later user changes cannot be reset by the old marker.
• Generic App Server method-not-found responses continue to map to an unsupported-host result instead of an internal error.

Validation

• Web focused tests: 5 files, 103 tests
• Web TypeScript type-check and focused ESLint
• Core retired-configuration regression tests: 7 tests
• CLI extension status tests: 3 tests
• CLI method-not-found compatibility test: 1 test
• App Server protocol v3 and Shared Runtime IPC v17 contract tests
• i18n audit, appearance contract audit, and all theme color audits
• Core boundary and repository hygiene checks
• git diff --check and removed-concept residue scan
• Independent adversarial review: no reproducible P0-P2 blocking findings

Real Desktop, Peer, and Remote end-to-end interaction was not run locally; the focused owner and contract checks above cover the changed behavior.