Align CLAS proof & ENS conventions; remove legacy receipt root exports

[GsCommand]

Motivation

• Align runtime-core with the canonical CLAS stack contract and endpoint conventions for proof envelopes and ENS records.
• Remove legacy layered receipt APIs from the package root so the old protocol-commons/v1.1.0 model is no longer presented as the primary public API.
• Enforce stronger verifier semantics (hash algorithm, required signature kid, ENS compatibility) to close audit gaps and improve cross-repo compatibility.

Description

• Removed legacy root exports for the layered receipt API from src/index.ts so signReceipt, verifyReceipt, isSignedLayeredReceipt, and related types are no longer exported at package root. (Files changed: src/index.ts).
• Updated canonical proof to use metadata.proof.hash.alg = "SHA-256" and updated types, signer, signing, and verification code to emit/verify that exact string. (Files changed: src/compat.ts, src/canonicalize.ts).
• Enforced that metadata.proof.signature.kid is required, non-empty, and a string during verifyCommandLayerReceipt() and added schema-level error codes when missing. (Files changed: src/compat.ts, test/compat.test.ts).
• Reworked verifyCommandLayerReceipt() to return the canonical result shape { ok, status: "VERIFIED" | "INVALID", checks: { schema, canonical_hash, signature, signer }, errors } and to set per-check boolean flags and machine-readable error codes. (Files changed: src/compat.ts, test/compat.test.ts).
• Extended ENS resolution to include cl.receipt.signer and optional discovery TXT records cl.endpoint.runtime, cl.endpoint.verify, cl.endpoint.mcp, cl.endpoint.docs, and cl.endpoint.registry, returning them on resolveSignerFromENS() as typed metadata while keeping endpoints optional and non-critical to crypto verification. (Files changed: src/ens.ts, test/ens.test.ts).
• Annotated the SHA-256 audit vector in CANONICAL_TEST_VECTORS as independently verified and updated the README to show only the canonical CLAS proof envelope, the exact SHA-256 string, signature.kid usage, ENS signer records, and optional endpoint discovery metadata. (Files changed: src/canonicalize.ts, README.md).

Testing

• Ran npm install, npm run build, npm test, and npm run typecheck and observed all automated steps complete successfully with test suite passing. (Commands: npm install, npm run build, npm test, npm run typecheck).
• Test changes and assertions added/updated in test/compat.test.ts and test/ens.test.ts cover verifier return shape, required signature.kid, invalid-hash and invalid-signature cases, ENS signer parsing, and optional endpoint discovery, and all tests passed locally.
• Commit SHA for these changes is 0dbaae51c2ad0d355250a7c700bbf95387ecf397 and the changes were bundled into a draft PR with the branch fix/runtime-core-contract-and-ens-alignment.

---

Codex Task