refactor(core): migrate to Bun and converge acquisition policies and Agent boundaries

apps/server/test/system/proc-read.test.ts

@@ -1,7 +1,8 @@
 // 生产权限下读 /proc、/sys:Deno 2 不带 --allow-all 时 readTextFile 一律 NotCapable,
 // 编译产物的资源监控与沙箱内存看门狗曾因此静默取不到数(v0.3.34 运行状态页一直无数据)。
-// 这里用与 apps/server/deno.json compile 相同的权限起子进程,确认走 cat 兜底能读到。
+// 这里用与 apps/server/package.json compile 相同的权限起子进程,确认走 cat 兜底能读到。
 import { fileURLToPath } from "node:url";
+import { Command } from "@umt/runtime";
 import { describe, expect, it } from "vitest";
 
 const here = fileURLToPath(new URL(".", import.meta.url));
@@ -13,20 +14,10 @@ const r = await readResources();
 console.log(JSON.stringify({ stat: !!stat && stat.startsWith("cpu"), host: r.host != null, mem: r.meminfo != null }));
 `;
 
-describe.skipIf(Deno.build.os !== "linux")("readProcText 在生产权限下", () => {
+describe.skipIf(process.platform !== "linux")("readProcText 在生产权限下", () => {
   it("走 cat 兜底读到 /proc 与资源读数", async () => {
-    const out = await new Deno.Command(Deno.execPath(), {
-      args: [
-        "run",
-        "--no-prompt",
-        "--allow-net",
-        "--allow-env",
-        "--allow-sys",
-        "--allow-read",
-        "--allow-write",
-        "--allow-run=ffprobe,sha256sum,cat",
-        "-",
-      ],
+    const out = await new Command(process.execPath, {
+      args: ["run", "-"],
       stdin: "piped",
       stdout: "piped",
       stderr: "piped",