Sandboxed L1+L2 runtime substrate for ArkheKernel. Single fixed
pre-public version per user directive 2026-05-03 — no version churn
before subsequent corrections (which land on the same v0.13 line).
Sibling-published with ArkheKernel v0.13.0.

Key features: 3-band determinism (Core/Projection/Protocol-Correctness)
+ WASM-sandboxed hook host v2 + observer host v2 + Kani-verified
host-fn boundary + Hybrid Ed25519 + ML-DSA 65 (NIST FIPS 204) signing
inherited from kernel + 5-property Kani harness suite (authorize,
dispatch, replay, memory_bounds_check, hybrid_and_mode) + 2 forge
TLA+ refinement modules (runtime_core + r4_implementation_refinement).

Cross-repo path dependency on ArkheKernel during development; transitions
to crates.io after both repos publish.