align runtime to canonical runtime-core API

[GsCommand]

Motivation

• Align the runtime to a verified runtime-core commit that provides the canonical receipt/signature API (CANONICAL_METHOD, buildCanonicalProof, signCommandLayerReceipt, verifyCommandLayerReceipt, isSignedCommandLayerReceipt).

Description

• Pin @commandlayer/runtime-core to commit 2518d4f93bb85290d85f781f40f4f3472440e0f3 by updating package.json and the resolved ref in package-lock.json.
• The target runtime-core commit is known to export the canonical API symbols required by the runtime, and the change was committed on branch work with a contract-aware commit message and a draft PR record was created.

Testing

• npm install was attempted and failed due to github.com DNS resolution (Could not resolve hostname github.com), so dependency resolution and npm test could not run.
• The local node_modules/@commandlayer/runtime-core was stale versus the target commit, so local export checks were invalid.
• CI is required to validate dependency resolution and run the repository tests, and this PR must remain a draft and must not be merged until CI is green.

---

Codex Task