fix(core): harden contracts and raise coverage

[EmersonBraun]

Summary

This PR isolates the @agentskit/core remediation batch from the previous stacked ecosystem branch.

It follows the agreed method:

1. Resolve P0/P1/P2 findings by root cause while preserving open, plug-and-play, configurable, no-lock-in behavior.
2. Verify essential functionality and public contracts before nice-to-have work.
3. Keep executable coverage above 90% for the configured package metrics and add regression/contract checks.
4. Analyze and update README, human docs, agent handoff, examples, public claims, and Doc Bridge artifacts.

AKOS / agentskit-os is outside this scope.

Changes

• Hardened core persistence, parsing, manifest schemas, localStorage, JWKS/OIDC, controller lifecycle, and tool proposal boundaries.
• Added bounded runtime validation for untrusted memory and manifest inputs.
• Added parseToolArgs for fail-closed tool argument handling while retaining safeParseArgs compatibility behavior.
• Updated the core README, human reference, agent handoff, public subpath catalog, and Doc Bridge index.
• Added documentation regression coverage for the public core export map.
• Added a core patch changeset.

Evidence

• Core tests: 487/487 passed.
• Coverage: statements 96.48%, branches 90.48%, functions 97.65%, lines 98.24%.
• Core lint: passed.
• Core build (CJS/ESM/DTS): passed.
• pnpm test:reference-docs: 12/12 passed after building the runtime fixture dependency.
• pnpm docs:bridge:gate: fresh index, 25 human links, documentation standard 7/7 required rules, and 25 action-ready handoffs passed.

Scope and limitations

• This PR contains only the core batch plus the minimal shared test/config and documentation bridge files required by it.
• Other library batches remain in the original stacked branch and will follow as separate PRs.
• ak-verify is unavailable in this environment; no audit finding is marked formally resolved or complete.
• No external issues were created, edited, or closed. No publication or deployment was performed.

[github-actions]

Lighthouse

URL	Performance	Accessibility	Best practices	SEO
http://127.0.0.1:3000/	73	92	96	100
http://127.0.0.1:3000/docs	70	100	96	100
http://127.0.0.1:3000/docs/get-started/getting-started/quickstart	72	96	96	100
http://127.0.0.1:3000/stack	88	100	96	100
http://127.0.0.1:3000/showcase	92	100	96	100

Run by .github/workflows/lighthouse.yml.

[github-actions]

Lighthouse

URL	Performance	Accessibility	Best practices	SEO
http://127.0.0.1:3000/	54	92	96	100
http://127.0.0.1:3000/docs	69	100	96	100
http://127.0.0.1:3000/docs/get-started/getting-started/quickstart	69	96	96	100
http://127.0.0.1:3000/stack	93	100	96	100
http://127.0.0.1:3000/showcase	92	100	96	100

Run by .github/workflows/lighthouse.yml.

[github-actions]

Lighthouse

URL	Performance	Accessibility	Best practices	SEO
http://127.0.0.1:3000/	49	92	96	100
http://127.0.0.1:3000/docs	72	100	96	100
http://127.0.0.1:3000/docs/get-started/getting-started/quickstart	73	96	96	100
http://127.0.0.1:3000/stack	91	100	96	100
http://127.0.0.1:3000/showcase	90	100	96	100

Run by .github/workflows/lighthouse.yml.