Tighten runtime verify coverage, add CHANGELOG, and remove in-repo SDK tests

[GsCommand]

Motivation

• Provide real production-surface tests that exercise the makeReceipt() signing path and the POST /verify behavior implemented in server.mjs so the runtime's core signing+verification flow is covered by unit tests.
• Scope the repository to the runtime service layer by removing the in-repo SDK test subtree and cleaning up test/README references that pointed at sdk/.
• Ship a concise, factual CHANGELOG.md documenting a credible v1.0.0 baseline and the current unreleased work for this change.

Description

• Added a new/updated runtime test file runtime/tests/runtime-signing.test.mjs with focused production-surface tests that exercise makeReceipt() (via verb calls) and POST /verify for wrapped and bare receipts, tamper detection, ENS-backed verification, and strict_kid behavior.
• Removed the in-repo SDK test subtree (sdk/typescript-sdk/tests/*.test.mjs) and updated package.json test:unit to only run the runtime tests (node --test runtime/tests/*.test.mjs).
• Added CHANGELOG.md at the repo root with an Unreleased section and a factual v1.0.0 entry describing the runtime service, health endpoints, and /verify.
• Updated README verification guidance to point at the production server.mjs verification path and adjusted a brief comment in the legacy runtime/src/receipt-verification.js to reflect remaining compatibility tests.

Testing

• Ran node --check server.mjs and npm run check to validate syntax, which completed successfully.
• Ran the new runtime unit tests with node --test runtime/tests/runtime-signing.test.mjs, which passed all subtests.
• Ran npm run test:unit (now only runtime unit tests) and npm test (unit tests + node tests/smoke.mjs), and both completed successfully with all tests and smoke checks passing.
• No production runtime behavior was changed and @commandlayer/runtime-core was not pinned in this pass, per constraints.

---

Codex Task