refactor(mobile): Phase 80 thin hubClient over shared SSOT

AGENTS.md

@@ -56,8 +56,10 @@ Mobile 主线是 Expo + React Native development build。旧 Tauri Mobile 不再
 
 - API 契约写在 `api/`。
 - 通用 UI、transcript、composer、inspector、platform contract 放 `app/shared/`。
+- Hub REST/WS 方法与 DTO 的 SSOT 是 `app/shared/src/hubClient.ts`（及拆出的 payload/extended 模块）。Desktop/Web/Mobile 的 `src/api/hubClient.ts` 只能是 thin shell（平台默认 baseUrl、Tauri proxy、SecureStore token、fixture snapshot、WS URL 等胶水）；禁止在客户端再分叉 REST 实现。
 - Desktop 只能把 Tauri/Rust native 能力放在 `app/desktop/src-tauri/`。
 - Web 只能通过 Hub/Web adapter 访问远端能力，不能直连 Local Edge 或 runtime。
+- Mobile（Expo/RN）同样 **Hub-only**：只走 Hub 合同与 shared hubClient；不得直连 Local Edge、raw runtime 或 Desktop host。详见 `app/mobile-rn/README.md`。
 - Desktop renderer 不获得 raw process execution 权限；本地执行由 Local Edge 和 Tauri host typed API 承担。
 
 ## 3. 产品术语

app/mobile-rn/README.md

@@ -8,6 +8,8 @@ Historical longform notes are indexed in [docs/history.md](../../docs/history.md
 
 - Keep Mobile aligned with Desktop/Web workbench terminology and Hub event contracts.
 - Keep shared imports RN-safe; do not import shared Web/Desktop UI, CSS modules, Tauri APIs, browser storage, or raw runtime execution code.
+- **Hub-only data plane**: Mobile talks to Hub (`/client/*`, `/web/*` via shared hubClient). It must **not** open Local Edge (`127.0.0.1:3210`), raw process/runtime APIs, or Desktop Tauri host commands. Local execution remains Desktop + Local Edge.
+- Hub client SSOT is `@agenthub/shared/hubClient`. `src/api/hubClient.ts` is a thin shell (async SecureStore token, fixture snapshot, WS helpers only). Do not add new REST methods on Mobile — add them to shared first.
 - Treat Feishu/Lark mobile screenshots as density and interaction references only.
 - Do not claim native/device/live-Hub/TokenDance-ID proof unless the relevant approved-real or development-build gate was run in the current task and evidence was recorded.