fix(console): keep required channel services selected

[AbigailDeng]

Problem and solution

The Channels Services picker allowed binding a bot without ornn-api or
chrono-llm-public, and both could be removed individually or through Select all.
Bind and Edit now preselect and lock these services, mark them Required, and keep
them selected through bulk and filtered changes. Other services remain optional.

Required services are matched by exact slug in the current authorized, active
NyxID inventory. Requests contain their actual UserService IDs. Missing access
blocks submission, including direct form submission, with an access message and
retry action. No permissions are granted automatically.

Saving an older nyxid_default registration uses the displayed explicit
allowlist. The form explains that this replaces NyxID default access; it does not
guess which services those defaults included. Existing explicit optional choices
are retained.

Scope

• Reuse ChannelConfigurationPage and ChannelServicePicker for Bind and Edit.
• Add matching English and Chinese messages.
• Update the Channel Bot Adoption specification and rendered integration tests.
• No backend, auth, route, dependency, or design-baseline artifact changes.

Local verification

Commands below ran from apps/aevatar-console-web/ unless noted.

Scope analysis, from the repository root:

python3 /Users/abigaildeng/.codex/skills/frontend-incremental-pr/scripts/frontend_change_scope.py --repo . --base origin/feat/2026-08-04_workflow-activity-vnext

Dependency preflight selected exactly two related test files:

pnpm exec jest --listTests --findRelatedTests src/pages/workflow-activity-vnext/channels/ChannelConfigurationPage.tsx src/pages/workflow-activity-vnext/channels/ChannelServicePicker.tsx

Changed test plus all preflight-selected tests, explicitly run: 2 suites,
137 tests passed. Locales were excluded from discovery because of their global
fan-out; the rendered feature tests cover the changed messages and behavior.

pnpm exec jest --runInBand --runTestsByPath src/pages/workflow-activity-vnext/channels/ChannelEditPage.test.tsx src/pages/workflow-activity-vnext/index.test.tsx

Changed-file static checks: passed, five files.

pnpm exec biome check src/locales/channelMessages.en-US.ts src/locales/channelMessages.zh-CN.ts src/pages/workflow-activity-vnext/channels/ChannelConfigurationPage.tsx src/pages/workflow-activity-vnext/channels/ChannelServicePicker.tsx src/pages/workflow-activity-vnext/channels/ChannelEditPage.test.tsx

Repository-root checks: passed.

PATH=/opt/homebrew/opt/python@3.12/libexec/bin:$PATH bash tools/ci/test_stability_guards.sh
git diff --check

Browser verification reused the existing Chrome tab against the configured remote
backend. Confirmed two checked disabled services, optional selection, bulk
selection/deselection, and filtered required-only selection. No live bot binding
or configuration was submitted. The preview remains at http://localhost:5197.

Full frontend suite/build: deferred to GitHub CI by personal local workflow
policy. Full typecheck is also delegated to CI because there is no reliable
repository-native affected typecheck target. CI has not been awaited locally.

Design baseline

Design baseline:
  apps/aevatar-console-web/docs/design-baselines/workflow-activity-vnext/
Primary design:
  aevatar-workflow-activity-vnext.excalidraw
Design SHA-256:
  30e74d7b410ae72c4c91432355436679033679c54c10b1702908435b001577de
Contract specification:
  apps/aevatar-console-web/docs/superpowers/specs/2026-08-04-workflow-activity-vnext-design.md
User paths:
  apps/aevatar-console-web/docs/superpowers/specs/2026-08-04-workflow-activity-vnext-user-paths.md
Channels supplement:
  apps/aevatar-console-web/docs/superpowers/specs/2026-09-17-channel-bot-adoption.md
Channels Figma:
  https://www.figma.com/design/FaVJx5IZeQX9jHcUi55ndB/?node-id=124-642
Authentication and localization:
  Existing Aevatar login, callback, session, returnTo, and Umi locale logic.
Production data source:
  Real APIs and API-acknowledged user actions only; no mock fallback.
Baseline integrity:
  Baseline artifacts unchanged; current user request defines the required-selection adjustment.