feat: workshop advanced generation pipeline (Phase 1)

[SevenBT]

Summary

Implements Phase 1 of the Workshop Advanced Generation feature: a deterministic, security-gated pipeline for building and installing generated tools. Work is split into focused commits (design docs → build pipeline → tool safety gates → core generation → UI/i18n → security docs) so the full branch history is preserved on merge.

Key changes:

• Build pipeline (app/core/tool_build/): strict manifest v1 parsing, staging workspace, deterministic loadability-only validation, atomic no-clobber installer with conditional rollback, and an orchestrating service. Adds TOOL_BUILDS_DIR under data/.
• Tool safety gates: reject execution of disabled tools in the registry; skip user tools whose name conflicts with an existing tool in the loader.
• Core generation: extend llm_gateway and tool_generator for the advanced generation flow.
• UI + i18n: tool build review dialog/workers and reworked generation dialog, with EN/ZH strings.
• Security docs: document the generated-tool build boundary and stable policy metadata (generated code is untrusted; workspaces are not OS sandboxes; validation is loadability-only, not a safety proof).

Related issue

Type of change

• Bug fix
• New feature
• Refactor / code quality
• Documentation
• Other

How it was verified

• pytest -q passes (with QT_QPA_PLATFORM=offscreen set)
• New / changed functionality has corresponding tests
• Manually verified the related UI / interaction

uv run python scripts/check_repo.py passes and the full pytest -q suite is green (~660 tests). Every implementation commit ships with matching tests (build pipeline, safety gates, generation, UI, and security-doc conformance).

Checklist

• Commit messages are in English and follow Conventional Commits
• No personal config (config/app_config.json) or secrets committed
• Read CONTRIBUTING.md