fix: make Agent updates reliable and visible

Valid Agent packages could be rejected when packaged trusted-key JSON used CRLF, and Settings could not show whether a newer compatible Agent existed. Registry formatting is now parsed independently of cryptographic trust, and Settings reads only the signed catalog to report local and latest versions.

New installations use a credential-free local Ollama-compatible profile. The v20 migration changes only untouched historical defaults, while explicit profiles and legacy environment aliases remain compatible. Magic Notes count badges no longer shift navigation rows.

Release note: 修复 Agent 下载兼容性并在设置中显示更新状态；新安装默认连接本地模型，保留显式用户配置；魔法笔记待办数字不再改变侧栏菜单高度。

src/shared/agent-installation-contracts.test.ts

@@ -133,6 +133,20 @@ describe('Agent installation contracts', () => {
     ).toThrow()
   })
 
+  it('rejects Base64 encodings with non-zero padding bits', () => {
+    expect(() =>
+      agentReleaseKeyRegistrySchema.parse({
+        formatVersion: 1,
+        keys: [{
+          keyId: 'test-key',
+          publicKeySpkiBase64: 'ZE==',
+          environment: 'test'
+        }],
+        revocations: []
+      })
+    ).toThrow('canonical Base64')
+  })
+
   it('requires both locked Linux targets and the fixed Node patch', () => {
     const target = {
       archive: 'node.tar.gz',