feat(arcrun): implement arcrun MVP — open-source AI workflow engine

Phase 1-5 complete per .agents/specs/u6u-core-mvp/:

**Phase 1 — Cherry-pick & cleanup**
- Create arcrun/ from cypher-executor, credentials, builtins, registry
- Remove 9 InkStone Service Bindings (KBDB, REGISTRY, CLINIC_*, AICEO, MINI_ME)
- Rewrite component-loader: 3-layer (builtin → WASM_BUCKET R2 → error)
- Remove autoPublishMissing.ts, proxy.ts (AICEO), execution-logger.ts (KBDB)
- Clean all KV namespace IDs and InkStone internal URLs from config files

**Phase 2 — contract.yaml completeness**
- Add credentials_required to gmail, google_sheets, telegram, line_notify
- Add config_example to all 21 components with annotated field descriptions

**Phase 3 — Credential injection**
- Add credential-injector.ts: AES-GCM decrypt from CREDENTIALS_KV
- Integrate into GraphExecutor before WASM execution
- Structured errors with repair instructions when credential missing

**Phase 4 — CLI (acr)**
- cli/package.json: arcrun package, bin: acr, deps: commander/js-yaml/chalk/ora
- 8 commands: init, creds push, push, run, validate, parts, list, logs
- Standard mode: writes directly to user's CF KV via CF REST API
- acr init: interactive setup with arcrun.dev API Key registration

**Phase 5 — Open source release prep**
- README.md: 5-minute quickstart, component table, workflow YAML syntax
- CONTRIBUTING.md: TinyGo dev env, component scaffolding, submission flow
- Security audit: no InkStone internal URLs/IDs in committed files
- .gitignore: exclude credentials.yaml, .wrangler, *.wasm

https://claude.ai/code/session_01BnCdSLVH8tUed9VrrPavgT

registry/tests/validateContract.test.ts

@@ -0,0 +1,113 @@
+// 單元測試：validateContract
+// Requirements: 1.1, 1.2, 11.5
+
+import { describe, it, expect } from 'vitest';
+import { validateContract } from '../src/actions/validateContract';
+
+const VALID_CONTRACT = {
+  canonical_id: 'validate_json',
+  display_name: 'JSON 格式驗證器',
+  category: 'logic',
+  version: 'v1',
+  wasi_target: 'preview1',
+  stability: 'floating',
+  runtime_compat: ['cf-workers', 'wazero'],
+  constraints: {
+    max_size_kb: 2048,
+    max_cold_start_ms: 50,
+    no_network_syscall: true,
+    io_model: 'stdin_stdout_json',
+  },
+  input_schema: { type: 'object', required: ['json_string'] },
+  output_schema: { type: 'object', properties: { valid: { type: 'boolean' } } },
+  gherkin_tests: [
+    { scenario: 'happy path', given: '{"json_string":"{}"}', then_contains: '{"valid":true}' },
+    { scenario: 'error path', given: '{"json_string":"bad"}', then_contains: '{"valid":false' },
+  ],
+};
+
+describe('validateContract', () => {
+  it('完整合約通過驗證', () => {
+    const result = validateContract(VALID_CONTRACT);
+    expect(result.valid).toBe(true);
+    expect(result.missing_fields).toHaveLength(0);
+    expect(result.errors).toHaveLength(0);
+  });
+
+  it('缺少 canonical_id 時回傳 missing_fields', () => {
+    const { canonical_id: _, ...rest } = VALID_CONTRACT;
+    const result = validateContract(rest);
+    expect(result.valid).toBe(false);
+    expect(result.missing_fields).toContain('canonical_id');
+  });
+
+  it('缺少 version 時回傳 missing_fields', () => {
+    const { version: _, ...rest } = VALID_CONTRACT;
+    const result = validateContract(rest);
+    expect(result.valid).toBe(false);
+    expect(result.missing_fields).toContain('version');
+  });
+
+  it('缺少 constraints.io_model 時驗證失敗', () => {
+    const contract = {
+      ...VALID_CONTRACT,
+      constraints: {
+        max_size_kb: 2048,
+        max_cold_start_ms: 50,
+        no_network_syscall: true,
+        // io_model 缺失
+      },
+    };
+    const result = validateContract(contract);
+    expect(result.valid).toBe(false);
+    // io_model 缺失時可能在 missing_fields 或 errors 中
+    const allIssues = [...result.missing_fields, ...result.errors];
+    expect(allIssues.some(f => f.includes('io_model'))).toBe(true);
+  });
+
+  it('gherkin_tests 少於 2 個時驗證失敗', () => {
+    const contract = {
+      ...VALID_CONTRACT,
+      gherkin_tests: [
+        { scenario: 'only one', given: '{}', then_contains: '{}' },
+      ],
+    };
+    const result = validateContract(contract);
+    expect(result.valid).toBe(false);
+  });
+
+  it('category 不在允許集合時驗證失敗', () => {
+    const contract = { ...VALID_CONTRACT, category: 'invalid_category' };
+    const result = validateContract(contract);
+    expect(result.valid).toBe(false);
+  });
+
+  it('wasi_target 不是 preview1 時驗證失敗', () => {
+    const contract = { ...VALID_CONTRACT, wasi_target: 'preview2' };
+    const result = validateContract(contract);
+    expect(result.valid).toBe(false);
+  });
+
+  it('version 格式不符時驗證失敗', () => {
+    const contract = { ...VALID_CONTRACT, version: '1.0.0' };
+    const result = validateContract(contract);
+    expect(result.valid).toBe(false);
+  });
+
+  it('canonical_id 含大寫時驗證失敗', () => {
+    const contract = { ...VALID_CONTRACT, canonical_id: 'ValidateJson' };
+    const result = validateContract(contract);
+    expect(result.valid).toBe(false);
+  });
+
+  it('空物件回傳所有必填欄位', () => {
+    const result = validateContract({});
+    expect(result.valid).toBe(false);
+    expect(result.missing_fields.length).toBeGreaterThan(0);
+  });
+
+  it('null 輸入回傳驗證失敗', () => {
+    const result = validateContract(null);
+    expect(result.valid).toBe(false);
+  });
+});