feat(registry): component_hash_id — stable id system for workflow references

Problem: canonical_id is readable but mutable; if a component is renamed,
all workflows referencing it by canonical_id break.

Solution: dual-id system
- component_hash_id: cmp_{sha256(canonical_id).slice(0,8)}, derived deterministically,
  never changes, safe for workflow references
- canonical_id: human-readable name, used for search and display
- idx:{canonical_id} KV key: reverse-lookup index for resolving canonical_id → hash_id

Changes:
- types.ts: SandboxResult.component_id → component_hash_id + canonical_id,
  added 'data' to category enum
- submitComponent.ts: deriveHashId(), writes idx: reverse-lookup on submit
- queryComponents.ts: full rewrite — removed KBDB dependency, uses SUBMISSIONS_KV;
  supports both cmp_* and canonical_id as query id; Phase 0 keyword search
  with note to upgrade to Vectorize in Phase 2
- sandboxAcceptance.ts: updated field names, fixed TextDecoder TS type
- ensureTemplate.ts: removed KBDB dependency, now a KV health check
- tests: updated component_id → canonical_id
- CONTRIBUTING.md: explain hash_id derivation and dual-id workflow reference syntax

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CONTRIBUTING.md

@@ -53,6 +53,12 @@ registry/components/my_component/
 所有語言共用相同的合約格式：
 
 ```yaml
+# component_hash_id 由 Registry 在提交時自動派發，格式為 cmp_{8碼hex}
+# 提交者不需要填這個欄位，Registry 會根據 canonical_id 確定性生成
+# Workflow 引用零件時，用 component_hash_id 才能保證永久不壞：
+#   component://cmp_a3f9b2c1   ← 推薦，即使 canonical_id 改名也不受影響
+#   component://string_reverse  ← 方便，AI 寫 workflow 時用這個，Registry 自動解析
+
 canonical_id: "string_reverse"     # 見下方命名規範
 display_name: "字串反轉"            # 人類可讀，可中文，供 UI 顯示用
 description: >                     # 語意搜尋用，見下方說明