Migrate test plugins to Rust and async-ify syscall modules

- Replace Python test plugins (echo, ai_test, claudecode) with Rust
  implementations driven by the plugin SDK
- Convert fs/network/process/timer syscall modules to async/await
- Change Network.OpenConn to return stream ConnEvent (conn_id handed
  to client in first "open" frame for Send/Close routing)
- Bind timer callbacks to plugin identity; stream_call subscriptions
  are identity-checked
- Update docs and regenerate Python SDK protobuf stubs

Verified: cargo build/test/clippy clean; echo + ai_test full syscall
suites pass; hermes & claudecode register and heartbeat; cross-plugin
bridge.call routing and auth denial verified end-to-end.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/03-实施路线.md

@@ -8,24 +8,27 @@
 - [x] 实现 Memory syscall(SQLite KV + FTS5 trigram search,默认写入 data/memory.db)
 - [x] 实现 Input syscall(stdin)
 - [x] 实现 Display syscall(stdout)
-- [x] 实现 Process syscall(spawn/kill/wait/stdin/stdout)
+- [x] 实现 Process syscall(spawn/kill/wait/stdin/stdout + watch channel 无竞态 wait)
 - [x] 实现 Timer syscall(once/cancel/now + 回调事件通道)
 - [x] 实现 Audio syscall(stub,待系统插件)
 - [x] 实现 HID syscall(stub,待系统插件)
-- [x] 实现 Network syscall(HTTP via curl,待替换)
+- [x] 实现 Network syscall(HTTP via reqwest)
 - [x] Plugin Bridge(注册/调用路由/心跳,注册状态写入 data/plugins.json)
 - [x] 插件加载:gRPC 握手 + 注册
-- [x] echo 测试插件(Python)验证基础链路
-- [x] ai_test 手动验证插件(Python,默认 disabled/autoload false)覆盖 Display/Memory/FS/Process/Timer/权限拒绝
+- [x] echo 测试插件(Rust)验证基础链路
+- [x] ai_test 手动验证插件(Rust,默认 disabled/autoload false)覆盖 Display/Memory/FS/Process/Timer/权限拒绝
 - [x] proto 定义:完整 9 个 service + PluginBridge
+- [x] 权限安全:无 x-plugin-id 的请求一律拒绝(UNAUTHENTICATED)
+- [x] 死插件路由保护:Bridge.call 校验 PluginStatus::Running
 
-**验证结果**:agentsd 启动 → Python 插件通过 gRPC 注册 → ai_test 调用 Display/Memory/FS/Process/Timer syscall 并验证权限拒绝。
+**验证结果**:agentsd 启动 → Rust 插件通过 gRPC 注册 → ai_test 调用 Display/Memory/FS/Process/Timer syscall 并验证权限拒绝。
 
-## 阶段 2:完善核心 syscall
+## 阶段 2:完善核心 syscall ✅ 部分完成
 
-- [ ] Network:替换 curl 为 hyper/reqwest 原生 HTTP client
-- [ ] FS.Watch:接入 notify-rs 文件监听
-- [ ] Timer.Cron:接入 cron 表达式解析
+- [x] Network:reqwest 原生 HTTP client(阶段 1 已完成)
+- [x] Network TCP 流:open_conn/send/close/listen 双向 TCP 通信
+- [x] FS.Watch:接入 notify-rs v7 文件监听(递归)
+- [x] Timer.Cron:接入 cron 表达式定时(7 段格式)
 - [ ] Audio:接入系统音频后端(wasapi/alsa)
 - [ ] HID:接入屏幕截取(Windows: win32 API)
 - [ ] Unix socket / Named pipe 传输(替代 TCP)