feat(arcrun): implement arcrun MVP — open-source AI workflow engine

Phase 1-5 complete per .agents/specs/u6u-core-mvp/:

**Phase 1 — Cherry-pick & cleanup**
- Create arcrun/ from cypher-executor, credentials, builtins, registry
- Remove 9 InkStone Service Bindings (KBDB, REGISTRY, CLINIC_*, AICEO, MINI_ME)
- Rewrite component-loader: 3-layer (builtin → WASM_BUCKET R2 → error)
- Remove autoPublishMissing.ts, proxy.ts (AICEO), execution-logger.ts (KBDB)
- Clean all KV namespace IDs and InkStone internal URLs from config files

**Phase 2 — contract.yaml completeness**
- Add credentials_required to gmail, google_sheets, telegram, line_notify
- Add config_example to all 21 components with annotated field descriptions

**Phase 3 — Credential injection**
- Add credential-injector.ts: AES-GCM decrypt from CREDENTIALS_KV
- Integrate into GraphExecutor before WASM execution
- Structured errors with repair instructions when credential missing

**Phase 4 — CLI (acr)**
- cli/package.json: arcrun package, bin: acr, deps: commander/js-yaml/chalk/ora
- 8 commands: init, creds push, push, run, validate, parts, list, logs
- Standard mode: writes directly to user's CF KV via CF REST API
- acr init: interactive setup with arcrun.dev API Key registration

**Phase 5 — Open source release prep**
- README.md: 5-minute quickstart, component table, workflow YAML syntax
- CONTRIBUTING.md: TinyGo dev env, component scaffolding, submission flow
- Security audit: no InkStone internal URLs/IDs in committed files
- .gitignore: exclude credentials.yaml, .wrangler, *.wasm

https://claude.ai/code/session_01BnCdSLVH8tUed9VrrPavgT

cypher-executor/src/lib/component-loader.ts

@@ -0,0 +1,49 @@
+import { BUILTIN_COMPONENTS } from './constants';
+import type { Bindings, ComponentRunner } from '../types';
+
+/**
+ * 建立零件載入器
+ *
+ * 三層優先序：
+ *   1. 內建零件（BUILTIN_COMPONENTS，純本地轉換，不需 R2）
+ *   2. WASM_BUCKET R2 直讀 → {componentId}/{componentId}.wasm
+ *   3. 找不到 → 結構化錯誤（含 R2 key 與修復說明）
+ */
+export function createComponentLoader(env: Bindings) {
+  return async (componentId: string): Promise<ComponentRunner> => {
+    // 層 1：內建零件（無需 R2）
+    const builtin = BUILTIN_COMPONENTS.get(componentId);
+    if (builtin) return builtin;
+
+    // 層 2：從 WASM_BUCKET R2 讀取
+    const wasmKey = `${componentId}/${componentId}.wasm`;
+    const wasmObj = await env.WASM_BUCKET.get(wasmKey);
+    if (wasmObj) {
+      const wasmBuffer = await wasmObj.arrayBuffer();
+      return createWasmRunner(componentId, wasmBuffer, env);
+    }
+
+    // 層 3：找不到
+    throw new Error(
+      `零件 ${componentId} 不存在。\n` +
+      `請確認 ${wasmKey} 已上傳至 WASM_BUCKET。\n` +
+      `修復：執行 acr parts 查看可用零件清單。`
+    );
+  };
+}
+
+/**
+ * 建立 WASM 零件執行器
+ * 使用 WASI preview1 stdin/stdout JSON I/O 模型
+ */
+function createWasmRunner(
+  componentId: string,
+  wasmBuffer: ArrayBuffer,
+  _env: Bindings,
+): ComponentRunner {
+  return async (ctx: unknown): Promise<unknown> => {
+    // 動態 import wasm-executor（避免頂層 import 造成 Worker 啟動問題）
+    const { executeWasm } = await import('./wasm-executor');
+    return executeWasm(componentId, wasmBuffer, ctx);
+  };
+}