refactor(build): unify component build and install workflow

[kongche-jbw]

Description

This PR introduces a unified build and install workflow for ANOLISA
components.

The main goal is to make source builds, user-local installs, system
installs, and future RPM packaging follow the same component-owned
make install contract. scripts/build-all.sh now orchestrates
component builds through isolated target/<component> staging
directories, while each component owns its install layout through its
Makefile where practical.

Highlights:

• Add unified scripts/build-all.sh orchestration.
• Add --install-mode user|system, --system, --usr, and --all.
• Stage build outputs under target/<component>.
• Keep default builds to core components, with agentsight included by
  --all or --component sight.
• Align system binaries under /usr/local/bin.
• Add component Makefile install contracts for copilot-shell, os-skills,
  ws-ckpt, tokenless, and agentsight.
• Align sec-core source and system install paths with the same profile
  model.
• Add adapter manifests for os-skills, sec-core, tokenless, and ws-ckpt.
• Install tokenless adapter resources and cosh extension resources.
• Install ws-ckpt and agentsight systemd services only in system mode.
• Stop systemd services before overwriting running service binaries.

Related Issue

no-issue

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional change)
• Performance improvement
• CI/CD or build changes

Scope

• cosh (copilot-shell)
• sec-core (agent-sec-core)
• skill (os-skills)
• sight (agentsight)
• tokenless (tokenless)
• Multiple / Project-wide

Reviewer Focus

Please focus review on:

• Whether the make install contract is reasonable for both source
  installs and future RPM packaging.
• Whether DESTDIR, PREFIX, BINDIR, and INSTALL_PROFILE are used
  consistently across components.
• Whether /usr/local/bin is acceptable as the unified system binary
  location.
• Whether user mode should continue to skip systemd and capability setup
  for ws-ckpt and agentsight.
• Whether adapter manifest and resource locations are suitable for
  future OpenClaw or other agent integrations.
• Whether sec-core's generated wrapper and venv install behavior are
  acceptable.

Expected Build Target Layout

Verified on Agentic_os with:

./scripts/build-all.sh --ignore-deps --no-install --all

[kongche-jbw]

sec-core

[kongche-jbw]

cosh