feat(arcrun): implement arcrun MVP — open-source AI workflow engine

Phase 1-5 complete per .agents/specs/u6u-core-mvp/:

**Phase 1 — Cherry-pick & cleanup**
- Create arcrun/ from cypher-executor, credentials, builtins, registry
- Remove 9 InkStone Service Bindings (KBDB, REGISTRY, CLINIC_*, AICEO, MINI_ME)
- Rewrite component-loader: 3-layer (builtin → WASM_BUCKET R2 → error)
- Remove autoPublishMissing.ts, proxy.ts (AICEO), execution-logger.ts (KBDB)
- Clean all KV namespace IDs and InkStone internal URLs from config files

**Phase 2 — contract.yaml completeness**
- Add credentials_required to gmail, google_sheets, telegram, line_notify
- Add config_example to all 21 components with annotated field descriptions

**Phase 3 — Credential injection**
- Add credential-injector.ts: AES-GCM decrypt from CREDENTIALS_KV
- Integrate into GraphExecutor before WASM execution
- Structured errors with repair instructions when credential missing

**Phase 4 — CLI (acr)**
- cli/package.json: arcrun package, bin: acr, deps: commander/js-yaml/chalk/ora
- 8 commands: init, creds push, push, run, validate, parts, list, logs
- Standard mode: writes directly to user's CF KV via CF REST API
- acr init: interactive setup with arcrun.dev API Key registration

**Phase 5 — Open source release prep**
- README.md: 5-minute quickstart, component table, workflow YAML syntax
- CONTRIBUTING.md: TinyGo dev env, component scaffolding, submission flow
- Security audit: no InkStone internal URLs/IDs in committed files
- .gitignore: exclude credentials.yaml, .wrangler, *.wasm

https://claude.ai/code/session_01BnCdSLVH8tUed9VrrPavgT

builtins/src/actions/initComponents.ts

@@ -0,0 +1,43 @@
+// initComponents：把所有內建零件上架到 Component Registry（via Service Binding）
+import type { Bindings } from '../types';
+import { buildComponentDefs } from '../types';
+
+async function publishOne(
+  registry: Fetcher,
+  def: ReturnType<typeof buildComponentDefs>[number],
+): Promise<{ id: string; status: number; ok: boolean; error?: unknown }> {
+  const payload = {
+    id: def.id,
+    name: def.name,
+    description: def.description,
+    url: def.url,
+    method: def.method,
+    tags: def.tags,
+    input_schema: JSON.stringify(def.input_schema),
+    output_schema: JSON.stringify(def.output_schema),
+    author: 'u6u-builtins',
+    version: '1.0.0',
+  };
+
+  const res = await registry.fetch('http://registry/components', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(payload),
+  });
+
+  const body = await res.json().catch(() => ({ error: 'parse error' }));
+  // 201 = 新建成功；409 = 已存在（也算 ok）
+  const isOk = res.status === 201 || res.status === 409 || res.ok;
+  return { id: def.id, status: res.status, ok: isOk, ...(!isOk && { error: body }) };
+}
+
+export async function initComponents(
+  env: Bindings,
+): Promise<{ ok: number; failed: number; results: unknown[] }> {
+  const defs = buildComponentDefs(env.WORKER_BASE_URL);
+  const results = await Promise.all(defs.map(def => publishOne(env.REGISTRY, def)));
+
+  const ok = results.filter(r => r.ok).length;
+  const failed = results.filter(r => !r.ok).length;
+  return { ok, failed, results };
+}