feat(canvas): add SDK-backed command runtime

[smackgg]

Summary

• Add canvas command list|describe|run to the npm CLI wrapper.
• Execute the public catalog through the shared Canvas SDK Store, business factories, restore path, and official sync transport.
• Keep authentication and service routing in the existing Go CLI; JavaScript only calls status/login/canvas get|allocate|apply.
• Add a hidden structured transport-result mode so SDK rejects are decoded without treating a successful server commit as a local failure.
• Vendor a fixed Node 16 CJS runtime with SHA-256 verification, third-party notices, deterministic provenance, and fail-closed release assembly.

Public surface

The catalog contains 42 entries: 30 mutations, four registered role/scene business commands, and read/checkpoint tools. Raw invoke_command, task files, headless modules, LibTV logic, internal npm package names, and direct service URLs are not exposed.

This capability belongs to the npm wrapper (npx @pippit-dev/cli). Existing standalone Go release binaries keep their current atomic canvas create|get|allocate|apply|upload commands.

Safety

• Write mutations run atomically.
• Sync transport uses one transaction per apply and no automatic network replay.
• Ambiguous transactions are quarantined and users are told to inspect state before retrying.
• Browser credential scope uses durable persistence/checkpoints; environment-key mode fails closed for durable checkpoint operations.
• All non-canvas command invocations still execute the existing Go binary unchanged.

Verification

• npm test passed, including all Go tests and go vet ./....
• Node 16.20.2 loaded and exercised the checked-in runtime.
• Windows amd64 and Linux amd64 Go cross-builds passed.
• npm pack contains the runtime, LEGAL, checksum, runner, and README.
• Extracted tarball: 42 commands, create_biz_node present, raw invoke_command absent.
• Runtime/pack scan has no LibTV, internal npm scope, local paths, source maps, or internal repository URLs.