feat(arcrun): recipe system + resumable workflow + component registry canon

Three new platform capabilities + one component (kbdb_get) to enable
real AI workflow execution through cypher binding YAML.

## Recipe System (容器 + Recipe 模式)
SDD: .agents/specs/recipe-system/

- prompt_recipe schema (Zod): fragments + inputs + assembly + output
- recipe-expander.ts: expand recipe ref → real prompt by fetching KBDB blocks
  + pulling context fields with transforms (pluck_content / extract_field / etc)
- 7 transform whitelist: json_array / to_string / join / markdown_list /
  extract_field / first / pluck_content
- graph-executor hooks: detect node.data.recipe → expand → inject into ctx
- output JSON parser (with markdown fence stripping for Claude-wrapped JSON)
- Stored in RECIPES KV under prompt_recipe:{name}

## Resumable Workflow (webhook callback resume)
SDD: .agents/specs/resumable-workflow/

- WorkflowPaused class + paused-runs.ts (persist/load/consume in EXEC_CONTEXT KV, 24h TTL)
- graph-executor: detect {pending:true, task_id} → persist state → throw WorkflowPaused
- cypher-handlers: catch → return {success:true, paused:true, task_id, run_id}
- POST /workflows/resume route: consume KV state → resumeFromPaused()
- Auto-inject callback_url for claude_api nodes (PUBLIC_BASE_URL or default cypher.arcrun.dev)
- claude_api/main.go: forward callback_url to Mira daemon, default timeout 25s→120s
- Idempotent (consume = load+delete)

## Component Registry Canon
SDD: .agents/specs/component-registry-canon/

- Add POST /components/index-only endpoint (metadata-only, no wasm/sandbox)
- Backfill script (mjs): scan registry/components/*/contract.yaml → submit to KV
- register-component.sh: SSOT for local + CI hook (deploy.yml change in next commit)
- Drop R2 dead storage from submitComponent + types + wrangler
- Schema relaxed: category enum + auth/ai/platform; cold_start 50→500ms; size 2→8MB

## kbdb_get component
- registry/components/kbdb_get/: TinyGo WASM, two modes (block_id / page_name list)
- .component-builds/kbdb_get/: WASI shim worker (kbdb-get.arcrun.dev)

End-to-end validation: AI uses MCP execute_workflow with recipe ref →
cypher-executor expands prompt from KBDB schema/skill blocks + drafts →
claude_api calls Mira daemon → daemon callback fires resume route →
workflow continues. Verified with real 2KB+ Karpathy LLM Wiki draft.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

registry/src/types.ts

@@ -5,7 +5,6 @@ import { z } from 'zod';
 // ── Cloudflare Bindings ──────────────────────────────────────────────────────
 
 export type Bindings = {
-  WASM_BUCKET: R2Bucket;
   AI: Ai;
   // KV key 格式：
   //   comp:{hash_id}:{version}   → 零件元數據（hash_id = cmp_ + sha256 前 8 碼）
@@ -17,10 +16,13 @@ export type Bindings = {
 
 // ── Component Contract Schema（Zod）─────────────────────────────────────────
 
+// max_cold_start_ms 上限放寬至 500（從 50）：實測 auth/ai 類零件含 crypto/init 步驟通常 100-300ms
+// no_network_syscall / no_filesystem_syscall 都改 optional：auth/api 類零件需要網路 syscall
 export const ConstraintsSchema = z.object({
-  max_size_kb: z.number().positive().max(2048),
-  max_cold_start_ms: z.number().positive().max(50),
-  no_network_syscall: z.boolean(),
+  max_size_kb: z.number().positive().max(8192),
+  max_cold_start_ms: z.number().positive().max(500),
+  no_network_syscall: z.boolean().optional(),
+  no_filesystem_syscall: z.boolean().optional(),
   io_model: z.literal('stdin_stdout_json'),
 });
 
@@ -36,7 +38,8 @@ export const ComponentContractSchema = z.object({
   // 兩者都可以在 workflow 中引用，Registry 會互相解析
   canonical_id: z.string().min(1).regex(/^[a-z][a-z0-9_]*$/, 'canonical_id 必須為小寫底線格式'),
   display_name: z.string().min(1),
-  category: z.enum(['logic', 'api', 'ui', 'style', 'anim', 'data']),
+  // category 擴充：auth (auth primitive)、ai (Claude/AI 推論)、platform (平台底層 crypto/system)
+  category: z.enum(['logic', 'api', 'ui', 'style', 'anim', 'data', 'auth', 'ai', 'platform']),
   version: z.string().min(1).regex(/^v\d+$/, 'version 格式必須為 vN'),
   wasi_target: z.literal('preview1'),
   stability: z.enum(['floating', 'stable', 'pinned']),