refactor: P0-P3 fixes, C1 cleanup, architecture diagrams, go.work upgrade

- P0-1: ProviderError type + ReportStatus for precise 401/403 detection
- P0-2: Remove -config flag from deploy/homeagent.service
- P2-1: 5s debounce on context.go Save()
- P2-2→C1: Delete output_set_channel entirely
- P2-3: Extract mediaDataURL/mediaChat helpers
- P2-4: Dedup defaultSources var
- P3: Delete dead packages (embed/tokenizer/container/snapshot)
- P3: Delete dead functions (messagesToMap, RunStageAll)
- CL: Update .gitignore, docs, Makefile, gojieba removal
- Config: Delete config/config.yaml, update docs
- Arch: Remove EmitOutputTo from emitResponse
- CL-1: go.work 1.19→1.21
- Docs: Add Mermaid architecture diagrams to README
- Docs: Add kernel-rebuild requires plugin-rebuild note to PLUGIN_DEV.md

internal/lua/vm.go

@@ -164,16 +164,13 @@ func (v *VM) LoadAdapter(path string) error {
 
 func (v *VM) CallTransformRequest(name, rawJSON string) (string, error) {
 	v.mu.Lock()
-	adapter, ok := v.loaded[name]
-	v.mu.Unlock()
+	defer v.mu.Unlock()
 
+	adapter, ok := v.loaded[name]
 	if !ok {
 		return "", fmt.Errorf("adapter %s not loaded", name)
 	}
 
-	v.mu.Lock()
-	defer v.mu.Unlock()
-
 	fn := adapter.RawGetString("transform_request")
 	if fn == nil {
 		return "", fmt.Errorf("adapter %s missing transform_request", name)
@@ -194,16 +191,13 @@ func (v *VM) CallTransformRequest(name, rawJSON string) (string, error) {
 
 func (v *VM) CallTransformResponse(name, rawJSON string) (string, error) {
 	v.mu.Lock()
-	adapter, ok := v.loaded[name]
-	v.mu.Unlock()
+	defer v.mu.Unlock()
 
+	adapter, ok := v.loaded[name]
 	if !ok {
 		return rawJSON, nil
 	}
 
-	v.mu.Lock()
-	defer v.mu.Unlock()
-
 	fn := adapter.RawGetString("transform_response")
 	if fn == nil {
 		return rawJSON, nil
@@ -224,16 +218,13 @@ func (v *VM) CallTransformResponse(name, rawJSON string) (string, error) {
 
 func (v *VM) CallTransformStreamChunk(name, rawLine string) (string, error) {
 	v.mu.Lock()
-	adapter, ok := v.loaded[name]
-	v.mu.Unlock()
+	defer v.mu.Unlock()
 
+	adapter, ok := v.loaded[name]
 	if !ok {
 		return rawLine, nil
 	}
 
-	v.mu.Lock()
-	defer v.mu.Unlock()
-
 	fn := adapter.RawGetString("transform_stream_chunk")
 	if fn == nil {
 		return rawLine, nil
@@ -257,16 +248,13 @@ func (v *VM) CallTransformStreamChunk(name, rawLine string) (string, error) {
 
 func (v *VM) GetAdapterEndpoint(name string) string {
 	v.mu.Lock()
-	adapter, ok := v.loaded[name]
-	v.mu.Unlock()
+	defer v.mu.Unlock()
 
+	adapter, ok := v.loaded[name]
 	if !ok {
 		return ""
 	}
 
-	v.mu.Lock()
-	defer v.mu.Unlock()
-
 	if ep := adapter.RawGetString("endpoint"); ep != nil {
 		return ep.String()
 	}
@@ -275,16 +263,13 @@ func (v *VM) GetAdapterEndpoint(name string) string {
 
 func (v *VM) GetAdapterHeaders(name string) map[string]string {
 	v.mu.Lock()
-	adapter, ok := v.loaded[name]
-	v.mu.Unlock()
+	defer v.mu.Unlock()
 
+	adapter, ok := v.loaded[name]
 	if !ok {
 		return nil
 	}
 
-	v.mu.Lock()
-	defer v.mu.Unlock()
-
 	headers := make(map[string]string)
 	if ht := adapter.RawGetString("headers"); ht != nil {
 		if tbl, ok := ht.(*lua.LTable); ok {