[runtime] wrap canonical receipts in runtime metadata envelope

[GsCommand]

Motivation

• Preserve a strict verification boundary by keeping the canonical, signed receipt exactly as produced by runtime-core while moving runtime-only context (trace, actor, delegation/orchestration details) out of the canonical payload.
• Maintain backward compatibility for callers and tooling by making /verify accept either a bare canonical receipt or the new wrapper and by minimizing changes to verification/schema logic.

Description

• Change makeReceipt in server.mjs so it builds and signs a canonical receipt that excludes runtime-only fields like trace, actor, and delegation_result, and add wrapReceiptResponse to produce the wrapper { receipt, runtime_metadata } returned by verb endpoints.
• Update verb handlers in server.mjs to return the wrapper via res.json(wrapReceiptResponse(receipt, { trace, actor })) and return wrapper-shaped error receipts on signing errors.
• Update /verify logic in server.mjs to accept either a bare receipt or a wrapped object (via extractReceiptPayload), to normalize and verify the extracted canonical receipt with runtime-core, and to run schema validation against the extracted canonical receipt only.
• Refresh tests, smoke scripts, and fixtures to use the wrapper model and to exercise both compatibility paths by unwrapping when needed; specifically adjust runtime/tests/runtime-signing.test.mjs, tests/smoke.mjs, scripts/smoke.mjs, tests/fixtures/make-golden.mjs, tests/fixtures/golden.receipt.json, and tests/golden.mjs; also update README.md examples and guidance to document the new response shape and verification boundary.

Testing

• Ran npm run check and it completed successfully with no syntax errors.
• Ran unit tests with npm run test:unit and all tests passed (16/16 runtime tests passed).
• Regenerated and validated the golden fixture with node tests/fixtures/make-golden.mjs and node tests/golden.mjs which succeeded.
• Ran the full test script npm test (unit tests + smoke) and it completed successfully; note there is no ./e2e.sh in this repo so stack e2e was not run.

---

Codex Task