feat(mini-apps): real scoped Composio bridge + GitHub Dashboard

Phase 2 makes the Mini App bridge real instead of stubbed.

- New composio:execute-tool and composio:search-tools IPC channels
  (shared schema + main handlers reusing the agent's execute path)
- Bridge refactored to a scoped RPC: callAction/searchTools/isConnected/
  connect, enforced against each app's declared scope at the host
- Auth prompt: acting on a disconnected toolkit triggers Composio OAuth
- GitHub Dashboard sample: track repos, view their 20 most-recent open PRs
  with descriptions, plus the authenticated user's profile + contribution
  graph — all live via the bridge
- Twitter sample reverted to a local UI demo (X has no managed OAuth2)

apps/x/packages/shared/src/ipc.ts

@@ -1020,6 +1020,34 @@ const ipcSchemas = {
     req: z.object({}),
     res: ZListToolkitsResponse,
   },
+  // Mini Apps: execute a Composio tool by slug (scoped to a connected toolkit).
+  'composio:execute-tool': {
+    req: z.object({
+      toolkitSlug: z.string(),
+      toolSlug: z.string(),
+      arguments: z.record(z.string(), z.unknown()).optional(),
+    }),
+    res: z.object({
+      successful: z.boolean(),
+      data: z.unknown().optional(),
+      error: z.string().optional(),
+    }),
+  },
+  // Mini Apps: search Composio tools within a toolkit (returns slugs + schemas).
+  'composio:search-tools': {
+    req: z.object({
+      toolkitSlug: z.string(),
+      query: z.string(),
+    }),
+    res: z.object({
+      tools: z.array(z.object({
+        slug: z.string(),
+        name: z.string(),
+        description: z.string().optional(),
+      })),
+      error: z.string().optional(),
+    }),
+  },
   // Agent schedule channels
   'agent-schedule:getConfig': {
     req: z.null(),