fix: harden runtime operation capability contracts

[wolfiesch]

Follow-up to #118.

• require prompt permission for operation-derived slash commands across host, web, and Flutter
• preserve missing versus explicitly empty operation catalogs
• pin terminal-only fallback rows to the reviewed official OMP version and remove the fork-only command
• preserve argument hints and resolve discovered alias collisions deterministically
• add producer-to-client contract coverage

Verification: pnpm check; pnpm test.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.