fix(chat): restore group profile tool invocation

[g1e2x87]

Summary

• Problem: compatible providers can return registered tool calls as <function=NAME>{json}</function> text, leaving chat_profile_update uninvoked in chat flows.
• Why it matters: group and direct conversation profiles can fail to persist even when the model intends to update them.
• What changed: parse valid registered-tool fallback calls, clarify automatic conversation targeting, retain trusted runtime scope validation, bump to 0.8.19, and align audit/MCP/Cron and unrestricted HTTP regression coverage with the shipped runtime contract.
• What did not change: models still cannot select channel or chat_id; no new provider, channel, permission, or configuration surface was added.

Label Snapshot (required)

• Risk label (risk: low|medium|high): risk: high
• Size label (size: XS|S|M|L|XL, auto-managed/read-only): auto-managed
• Scope labels (core|agent|channel|config|cron|daemon|doctor|gateway|health|heartbeat|integration|memory|observability|onboard|provider|runtime|security|service|skillforge|skills|tool|tunnel|docs|dependencies|ci|tests|scripts|dev, comma-separated): provider, tool, cron, security, tests, docs
• Module labels (<module>: <component>, for example channel: telegram, provider: kimi, tool: shell): provider: compatible, tool: chat_profile_update, tool: mcp
• Contributor tier label (trusted contributor|experienced contributor|principal contributor|distinguished contributor, auto-managed/read-only; author merged PRs >=5/10/20/50): auto-managed
• If any auto-label is incorrect, note requested correction: None

Change Metadata

• Change type (bug|feature|refactor|docs|security|chore): bug
• Primary scope (runtime|provider|channel|memory|security|ci|docs|multi): multi

Linked Issue

• Closes #
• Related #
• Depends on #
• Supersedes #

Supersede Attribution

• Superseded PRs + authors: None
• Integrated scope by source PR: None
• Co-authored-by trailers added for materially incorporated contributors? No
• If No, explain why: no superseded PR or external code was incorporated
• Trailer format check: Pass

Validation Evidence (required)

Commands and result summary:

cargo fmt --all -- --check
cargo check --workspace --no-default-features
RUSTFLAGS="-D warnings" cargo clippy --workspace --all-targets
cargo test --workspace

• Evidence provided: all commands passed; workspace test run reported 5703 library tests passed, 6 ignored, with integration and doc tests passing.
• If any command is intentionally skipped, explain why: no validation from the recorded delivery gate was skipped.

Security Impact (required)

• New permissions/capabilities? No
• New external network calls? No
• Secrets/tokens handling changed? No
• File system access scope changed? No
• If any Yes, describe risk and mitigation: N/A. Fallback parsing accepts only registered tool names with valid JSON arguments, and trusted conversation scope injection remains mandatory.

Privacy and Data Hygiene (required)

• Data-hygiene status: pass
• Redaction/anonymization notes: no production payloads, credentials, personal identifiers, or private endpoints are included.
• Neutral wording confirmation: project-native and subsystem-focused wording used.

Compatibility / Migration

• Backward compatible? Yes
• Config/env changes? No
• Migration needed? No
• If yes, exact upgrade steps: N/A

Human Verification (required)

• Verified scenarios: deployed 0.8.19 direct-chat chat_profile_update invocation succeeded; installed binary and active process hashes match; current doctor reports 22 ok, 0 warnings, 0 errors.
• Edge cases checked: model-supplied target rejection, missing trusted scope, unregistered function names, malformed JSON fallback arguments, empty MCP candidate sets.
• What was not verified: a fresh agent-authored profile update from a real group conversation remains to be captured.

Side Effects / Blast Radius (required)

• Affected subsystems/workflows: compatible-provider response parsing, chat profile updates, MCP schema construction, Cron shell helper compatibility, audit lock-file opening, integration security expectations.
• Potential unintended effects: provider text containing function-like markup could be interpreted as a tool call; mitigation restricts parsing to registered names and valid JSON when structured calls are absent.
• Guardrails/monitoring for early detection: focused parser and profile tests, full workspace regression, tool execution audit logs, runtime doctor and health checks.

Agent Collaboration Notes

• Agent tools used: repository inspection, Git, GitHub CLI, deployed runtime diagnostics.
• Workflow/plan summary: preserved the existing commit, excluded unrelated untracked receipts and scratch work, and delivered through a dedicated branch per repository policy.
• Verification focus: tool-call parsing boundary, trusted scope preservation, runtime health, and remote commit identity.
• Confirmation: naming and architecture boundaries followed (AGENTS.md and CONTRIBUTING.md).

Rollback Plan (required)

• Fast rollback command/path: revert commit c39d7c19df385635c12789605c7bdb59192a2353, rebuild the release binary, atomically replace /home/ck/.cargo/bin/prx, and restart prx.service.
• Feature flags or config toggles: None
• Observable failure symptoms: compatible-provider tool calls remain visible as text, unexpected tool invocation from function-like text, or failed chat profile persistence.

Risks and Mitigations

• Risk: text fallback parsing could widen invocation behavior.
  • Mitigation: it runs only when structured tool calls are absent, only for registered tools, and only with valid JSON arguments.
• Risk: live group-chat acceptance has not yet been captured.
  • Mitigation: keep this explicitly visible as the remaining post-merge acceptance scenario.