fix: make Agent updates reliable and visible

Valid Agent packages could be rejected when packaged trusted-key JSON used CRLF, and Settings could not show whether a newer compatible Agent existed. Registry formatting is now parsed independently of cryptographic trust, and Settings reads only the signed catalog to report local and latest versions.

New installations use a credential-free local Ollama-compatible profile. The v20 migration changes only untouched historical defaults, while explicit profiles and legacy environment aliases remain compatible. Magic Notes count badges no longer shift navigation rows.

Release note: 修复 Agent 下载兼容性并在设置中显示更新状态；新安装默认连接本地模型，保留显式用户配置；魔法笔记待办数字不再改变侧栏菜单高度。

src/shared/contracts.ts

@@ -477,10 +477,10 @@ export const defaultContextCompressionSettings = {
 
 export const defaultRuntimeSettings = {
   provider: 'model',
-  modelBaseUrl: 'https://bigtoken.ai',
-  modelName: 'sonnet-5',
-  modelProtocol: 'anthropic-messages',
-  modelAuthentication: 'api-key',
+  modelBaseUrl: 'http://127.0.0.1:11434/v1',
+  modelName: 'qwen3',
+  modelProtocol: 'openai-chat-completions',
+  modelAuthentication: 'none',
   supportsImageInput: false,
   imageGenerationQuality: 'auto',
   opencodeBaseUrl: '',