feat(arcrun): implement arcrun MVP — open-source AI workflow engine

Phase 1-5 complete per .agents/specs/u6u-core-mvp/:

**Phase 1 — Cherry-pick & cleanup**
- Create arcrun/ from cypher-executor, credentials, builtins, registry
- Remove 9 InkStone Service Bindings (KBDB, REGISTRY, CLINIC_*, AICEO, MINI_ME)
- Rewrite component-loader: 3-layer (builtin → WASM_BUCKET R2 → error)
- Remove autoPublishMissing.ts, proxy.ts (AICEO), execution-logger.ts (KBDB)
- Clean all KV namespace IDs and InkStone internal URLs from config files

**Phase 2 — contract.yaml completeness**
- Add credentials_required to gmail, google_sheets, telegram, line_notify
- Add config_example to all 21 components with annotated field descriptions

**Phase 3 — Credential injection**
- Add credential-injector.ts: AES-GCM decrypt from CREDENTIALS_KV
- Integrate into GraphExecutor before WASM execution
- Structured errors with repair instructions when credential missing

**Phase 4 — CLI (acr)**
- cli/package.json: arcrun package, bin: acr, deps: commander/js-yaml/chalk/ora
- 8 commands: init, creds push, push, run, validate, parts, list, logs
- Standard mode: writes directly to user's CF KV via CF REST API
- acr init: interactive setup with arcrun.dev API Key registration

**Phase 5 — Open source release prep**
- README.md: 5-minute quickstart, component table, workflow YAML syntax
- CONTRIBUTING.md: TinyGo dev env, component scaffolding, submission flow
- Security audit: no InkStone internal URLs/IDs in committed files
- .gitignore: exclude credentials.yaml, .wrangler, *.wasm

https://claude.ai/code/session_01BnCdSLVH8tUed9VrrPavgT

registry/components/switch/component.contract.yaml

@@ -0,0 +1,66 @@
+canonical_id: "switch"
+display_name: "條件路由"
+category: "logic"
+version: "v1"
+wasi_target: "preview1"
+stability: "floating"
+runtime_compat:
+  - "cf-workers"
+  - "workerd"
+  - "wazero"
+constraints:
+  max_size_kb: 2048
+  max_cold_start_ms: 50
+  no_network_syscall: true
+  no_filesystem_syscall: true
+  io_model: "stdin_stdout_json"
+input_schema:
+  type: object
+  required: [value, cases]
+  properties:
+    value:
+      type: string
+      description: 要比對的值
+    cases:
+      type: array
+      items:
+        type: object
+        properties:
+          match:
+            type: string
+          branch:
+            type: string
+    default_branch:
+      type: string
+      description: 無匹配時的預設分支
+output_schema:
+  type: object
+  properties:
+    success:
+      type: boolean
+    data:
+      type: object
+      properties:
+        branch:
+          type: string
+gherkin_tests:
+  - scenario: "匹配到 case"
+    given: '{"value":"a","cases":[{"match":"a","branch":"branch_a"}],"default_branch":"default"}'
+    then_contains: '"branch":"branch_a"'
+  - scenario: "走 default 分支"
+    given: '{"value":"z","cases":[{"match":"a","branch":"branch_a"}],"default_branch":"fallback"}'
+    then_contains: '"branch":"fallback"'
+  - scenario: "無效 JSON"
+    given: 'not-json'
+    then_contains: '{"success":false'
+tags: [builtin, switch, branch, route, condition]
+description: "依值路由到對應分支，支援多個 case 和 default 分支。"
+config_example: |
+  my_switch:                          # 節點名稱（可自訂）
+    value: "{{upstream.status}}"      # 要比對的值（必填）
+    cases:                            # case 清單（必填）
+      - match: active                 # 比對值
+        branch: branch_active         # 對應分支名稱
+      - match: inactive
+        branch: branch_inactive
+    default_branch: branch_default    # 無匹配時的預設分支（選填）

registry/components/switch/go.mod

@@ -0,0 +1,3 @@
+module component
+
+go 1.21

registry/components/switch/main.go

@@ -0,0 +1,61 @@
+// switch — 依值路由到對應分支
+//
+//go:build tinygo
+
+package main
+
+import (
+	"encoding/json"
+	"io"
+	"os"
+)
+
+type Case struct {
+	Match  string `json:"match"`
+	Branch string `json:"branch"`
+}
+
+type Input struct {
+	Value         string `json:"value"`
+	Cases         []Case `json:"cases"`
+	DefaultBranch string `json:"default_branch"`
+}
+
+func main() {
+	raw, err := io.ReadAll(os.Stdin)
+	if err != nil {
+		writeError("failed to read stdin: " + err.Error())
+		return
+	}
+	var input Input
+	if err := json.Unmarshal(raw, &input); err != nil {
+		writeError("invalid input JSON: " + err.Error())
+		return
+	}
+
+	for _, c := range input.Cases {
+		if c.Match == input.Value {
+			writeSuccess(c.Branch)
+			return
+		}
+	}
+
+	branch := input.DefaultBranch
+	if branch == "" {
+		branch = "default"
+	}
+	writeSuccess(branch)
+}
+
+func writeSuccess(branch string) {
+	out, _ := json.Marshal(map[string]interface{}{
+		"success": true,
+		"data":    map[string]interface{}{"branch": branch},
+	})
+	os.Stdout.Write(out)
+}
+
+func writeError(msg string) {
+	out, _ := json.Marshal(map[string]interface{}{"success": false, "error": msg})
+	os.Stdout.Write(out)
+}