feat: promote public runtime foundation

[egallmann]

Summary

Promotes the reviewed ste-runtime production foundation from develop to main.

The promotion includes the narrow Public Runtime SDK/workspace foundation and the modernized Node.js runtime/CI baseline.

Public runtime foundation

• narrow supported runtime SDK;
• explicit workspace registration lifecycle;
• UUIDv7 workspace, repository, and snapshot identities;
• deterministic workspace definition revisions;
• immutable observation snapshots;
• snapshot-bound graph traversal;
• projection-scoped GraphNodeRef;
• explicit provenance boundaries;
• fail-closed graph identity collision handling;
• current-source-only projection semantics;
• multi-repository workspace support;
• packed public-consumer qualification.

Runtime and CI baseline

• minimum supported Node.js runtime is Node 22;
• primary CI qualifies Node 22 and Node 24;
• Windows/macOS portability qualifies Node 24;
• Node typings align to the Node 22 minimum;
• branch protection uses the stable aggregate required test gate.

Boundaries preserved

• package remains private;
• package version remains 0.10.0-experimental;
• no npm publication;
• no package rename/scope decision;
• no CLI migration;
• no MCP migration;
• no federation implementation;
• no ADR Kit v1.5 work;
• no unrelated dependency modernization.

Validation

Qualified develop SHA: cf7daf1fa35d837a5daa14773dc586326b6066ea

Post-merge develop checks passed:

• Node 22 test;
• Node 24 test;
• Windows Node 24 portability;
• macOS Node 24 portability;
• Tests / required;
• CodeQL analyses;
• gitleaks;
• shape-patterns.

Develop package guards:

• private: true;
• version: 0.10.0-experimental;
• engines.node: >=22.0.0;
• @types/node: ^22.0.0.

No npm publication or GitHub release is claimed.