fix(mini-apps): reliability fixes + self-contained data loading

From two rounds of copilot build feedback:

- runtime: null-check hallucinated tool names (was crashing the whole run)
- add window.rowboat.fetch + builtin fetch-url: CORS-safe HTTP for UI and
  bg-task agents (no shell needed for plain HTTP)
- mini-app-set-data/install: reject stringified JSON; require object
- manifest dataContract (requiredKeys/nonEmptyArrayKeys) enforced on writes so
  a stray/legacy task can't corrupt an app's data or wipe series
- self-contained data: data.json is a served sibling (dist/), apps fetch it via
  relative URL; removed host-side data injection
- build-mini-app skill: CORS/fetch-url/no-shell/capable-model/dataContract gotchas

apps/x/packages/shared/src/ipc.ts

@@ -1033,6 +1033,23 @@ const ipcSchemas = {
     req: z.object({ id: z.string() }),
     res: z.object({ data: z.unknown().nullable() }),
   },
+  // Mini Apps: proxy an HTTP request through main (bypasses browser CORS for the
+  // sandboxed app origin). GET/POST to http(s) only.
+  'mini-apps:fetch': {
+    req: z.object({
+      url: z.string(),
+      method: z.string().optional(),
+      headers: z.record(z.string(), z.string()).optional(),
+      body: z.string().optional(),
+    }),
+    res: z.object({
+      ok: z.boolean(),
+      status: z.number(),
+      statusText: z.string(),
+      text: z.string(),
+      error: z.string().optional(),
+    }),
+  },
   'composio:didConnect': {
     req: z.object({
       toolkitSlug: z.string(),