Delegate Orrery graph reads to @policyengine/microcosm-provider-orrery

[anth-volk]

Fixes #3

Stacked on #1. Browser graph downloading/validation and server publication/evidence reads now use @policyengine/microcosm-provider-orrery, pinned exactly to 0.2.1 from npm (published with provenance by PolicyEngine/microcosm-emitter's release workflow). Next routes, React Orrery component, link state, authorization, immutable writes and Blob credentials remain here. Removes duplicated reader/contract implementation and moves its tests to the provider. Calibration live telemetry is unchanged.

Validation: 16 app-owned tests, formatting, lint, route/type generation and production build pass. Provider reader has its own 25 tests and packed-artifact/browser checks. No new cross-stack integration tests; no visual changes or hosted qualification.

The earlier "Before merge" items are done (see the comment for dfed13b): the npm package replaces the temporary Git dependency, bun.lock is regenerated, and the draft-only webpack extension alias is removed. No new environment variables or infrastructure required.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
microcosm-runs	Ready	Preview	Oct 14, 2026 7:58pm UTC

[anth-volk]

Commit dfed13b replaces the temporary Git dependency with the published npm package, which completes the "Before merge" items in this PR's description:

• @policyengine/microcosm-provider-orrery is pinned exactly to 0.2.1. PolicyEngine/microcosm-emitter's release workflow published it with provenance. Its typescript/orrery/src is identical to the previously pinned commit b9e8b680, so the reader's behaviour is unchanged.
• bun.lock is regenerated. The lock's integrity hash matches the tarball the release job published.
• The draft-only webpack extensionAlias and the transpilePackages entry are removed, because the registry package ships compiled JavaScript.
• The README section "Deferred provider adoption" is replaced with "Provider package".

Local checks: bun install --frozen-lockfile, format:check, lint, typecheck, bun test (16 pass) and bun run build all passed.

This PR still has no changelog fragment. It needs one once #7 (release automation) merges into #1's branch.

[anth-volk]

Closing unmerged. This app keeps its own publication reader (lib/contract.ts, lib/viewer.ts from #1), so changes to how it reads publications, such as #6's local directory mode, don't wait on an emitter release. This app was the package's only consumer; removing the package from the emitter is tracked in PolicyEngine/microcosm-emitter#15.