feat: 合并边缘节点运维并完善 Surge 配置安全

迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。

完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。

验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。

.claude/skills/edge-node-multi-protocol/scripts/warp-healthcheck.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# WARP proxy watchdog: WARP can show "Connected" while the SOCKS proxy stops egressing.
+# Checks warp=on through the SOCKS proxy; restarts warp-svc + reconnects if not.
+set -euo pipefail
+PROXY_ADDR="${PROXY_ADDR:-socks5h://127.0.0.1:40000}"
+TRACE_URL="${TRACE_URL:-https://www.cloudflare.com/cdn-cgi/trace}"
+TIMEOUT="${CURL_TIMEOUT:-15}"
+
+log() { logger -t warp-healthcheck "$*"; echo "warp-healthcheck: $*"; }
+
+if ! ss -lnt | grep -q '127.0.0.1:40000'; then
+  log "SOCKS listener missing; restarting warp-svc"
+elif trace="$(curl -k -sS --max-time "$TIMEOUT" --proxy "$PROXY_ADDR" "$TRACE_URL" 2>/dev/null)" && grep -q 'warp=on' <<<"$trace"; then
+  exit 0   # healthy
+else
+  log "warp not on via proxy; recovering"
+fi
+
+systemctl restart warp-svc 2>/dev/null || true
+sleep 8
+warp-cli --accept-tos connect 2>/dev/null || true