Fail the build on a bare catch, and say why each one is empty

[hsliuustc0106]

Fixes #205

A catch clause whose block holds neither a statement nor a comment swallows the error with nothing on record saying why that is safe. This adds check-empty-catch to .github/scripts/ (statement form only; the void p.catch(() => {}) idiom and test-helper retries stay out of scope, matching the issue's non-goals) with a test that asserts the shipped sources stay clean — the package job of tests-ok and root npm run verify already run it, so no workflow change. The sixteen bare catches it found in core/ and plugins/social now carry their reason as a comment; the rule is recorded in docs/code-standards.md ("Silent catches"). src/host/home-lock.js is an upstream file edited for the first time, so it joins the 0002-flybot-api-host topic; the client bundle is byte-identical (esbuild strips comments), and the patches were regenerated.

Review follow-ups landed in 59e0bc9: the gate's binding pattern now matches any catch(...) argument, so destructuring bindings (catch ({ message }) {}, catch ({}) {}) cannot evade it, and the hooks.js comment covers a resolve failure, not only an ended session. Remaining review notes are filed as #213.

Fail without change

At base (origin/main a63309f) plus only the two new script files: node .github/scripts/check-empty-catch.mjs exits 1 with 16 violations (core/index.js:71, src/client/index.js:50, src/client/flybot-registry.js:99, src/host/diagnostics.js:108,110, src/host/home-lock.js:53,83,92, src/host/hooks.js:819, plugins/social/index.js:35,37, plugins/social/client.js:900, plugins/social/src/social.js:297,392,1100, plugins/social/src/mcp-client.js:148). At the tip the gate and its tree test pass.

Verification

Tip SHA: 59e0bc98c3656de113e756d554ce9b774a738f7a

Ran (at the tip, worktree /tmp/flybot-205):

• npm run build in core/ → pass (client.js byte-identical: comment-only src/client edits)
• node scripts/ds-bot-patches.mjs generate + check → pass ("9 patches apply cleanly in order", "core/ equals ds-bot/ + patches/ds-bot/")
• TZ=UTC ARCH_DOCS_BASE=origin/main npm run verify → exit 0 at 47745ad (core 750/750, social 160/160, tree 56/56, repo scripts 60/60); at 59e0bc9 the same suites were run stepwise with the same results — core 750/750, social 160/160 (settled after the known flake below), tree 56/56, repo scripts 60/60, oxlint 28 warnings / 0 errors (same set as base), arch-docs OK (19 changed files, Docs-not-needed: trailers — comment-only edits to owned sources)
• node .github/scripts/check-empty-catch.mjs → exit 0, no violations

Not run:

• Smoke test — src/host/ changed (comments only, no behavior change) but the smoke bench needs a ../deepseek-harness checkout this machine does not have.
• Desktop / real-model steward-eval — comment-only diff, no behavior to observe.

Environment notes for the reviewer

• Run suites with TZ=UTC: three social face-room title tests format creation times and fail in a non-UTC local timezone — they fail identically at base.
• plugins/social #90 hidden Bot re-share is an intermittent local flake (createBot → resolveModel, "Available models: none"): it failed roughly 1 run in 3 at base as well as at the tips, more often under load; re-running the suite settles it. CI's fresh runner is the arbiter.
• A fresh worktree needs npm run harness in core/ (577 packages) before npm test/npm run lint resolve @deepseek-ai/*.