feat(arcrun): implement arcrun MVP — open-source AI workflow engine

Phase 1-5 complete per .agents/specs/u6u-core-mvp/:

**Phase 1 — Cherry-pick & cleanup**
- Create arcrun/ from cypher-executor, credentials, builtins, registry
- Remove 9 InkStone Service Bindings (KBDB, REGISTRY, CLINIC_*, AICEO, MINI_ME)
- Rewrite component-loader: 3-layer (builtin → WASM_BUCKET R2 → error)
- Remove autoPublishMissing.ts, proxy.ts (AICEO), execution-logger.ts (KBDB)
- Clean all KV namespace IDs and InkStone internal URLs from config files

**Phase 2 — contract.yaml completeness**
- Add credentials_required to gmail, google_sheets, telegram, line_notify
- Add config_example to all 21 components with annotated field descriptions

**Phase 3 — Credential injection**
- Add credential-injector.ts: AES-GCM decrypt from CREDENTIALS_KV
- Integrate into GraphExecutor before WASM execution
- Structured errors with repair instructions when credential missing

**Phase 4 — CLI (acr)**
- cli/package.json: arcrun package, bin: acr, deps: commander/js-yaml/chalk/ora
- 8 commands: init, creds push, push, run, validate, parts, list, logs
- Standard mode: writes directly to user's CF KV via CF REST API
- acr init: interactive setup with arcrun.dev API Key registration

**Phase 5 — Open source release prep**
- README.md: 5-minute quickstart, component table, workflow YAML syntax
- CONTRIBUTING.md: TinyGo dev env, component scaffolding, submission flow
- Security audit: no InkStone internal URLs/IDs in committed files
- .gitignore: exclude credentials.yaml, .wrangler, *.wasm

https://claude.ai/code/session_01BnCdSLVH8tUed9VrrPavgT

cypher-executor/wrangler.toml

@@ -0,0 +1,35 @@
+name = "arcrun-cypher-executor"
+main = "src/index.ts"
+compatibility_date = "2025-02-19"
+compatibility_flags = ["nodejs_compat"]
+
+# KV Context Store：節點 output 透過 KV 傳遞，解決同名欄位衝突
+# TTL 設為 1 小時，執行完後自動清除
+[[kv_namespaces]]
+binding = "EXEC_CONTEXT"
+id = ""   # 填入你的 KV Namespace ID
+
+# Webhook Store：儲存 Workflow 定義，key = workflow name
+[[kv_namespaces]]
+binding = "WEBHOOKS"
+id = ""   # 填入你的 KV Namespace ID
+
+# Credential Store：AES-GCM 加密存放用戶 API token
+# Standard 模式：供 credential-injector 讀取加密 token
+[[kv_namespaces]]
+binding = "CREDENTIALS_KV"
+id = ""   # 填入你的 Credentials KV Namespace ID
+
+# R2 Bucket：WASM 零件二進位（arcrun.dev 公眾零件庫，或自架時填入自己的 bucket）
+[[r2_buckets]]
+binding = "WASM_BUCKET"
+bucket_name = "arcrun-wasm"
+
+# Workers AI
+[ai]
+binding = "AI"
+
+[vars]
+ENVIRONMENT = "production"
+# MULTI_TENANT = "true"   # Standard 模式（預設）；設 "false" 啟用 Self-hosted 單租戶模式
+# ENCRYPTION_KEY 透過 wrangler secret 設定（hex-encoded 256-bit AES key）