fix runtime tests after canonical CLAS emitter migration

[GsCommand]

Motivation

• Tests and runtime boot broke after the canonical CLAS emitter migration due to incompatible @commandlayer/runtime-core imports and a drift in the /verify response shape.
• The runtime must continue to emit and verify the canonical CLAS proof envelope (metadata.proof.canonicalization, hash.{alg,value}, signature.{alg,value,kid}) without reintroducing legacy top-level proof fields.
• Restore legacy verification helpers and smoke assertions so repository-local unit/integration/smoke checks are green while preserving the canonical runtime-core migration.

Description

• Replaced unavailable runtime-core imports with canonical primitives and implemented a local canonical hashing helper that excludes mutable proof/receipt_id values before hashing, then sign the canonical hash with Ed25519 and emit the canonical proof envelope (metadata.proof.hash and metadata.proof.signature). (files: server.mjs)
• Reworked /verify to compute the canonical hash, validate the Ed25519 signature against metadata.proof.signature.value, preserve the ok/status/checks/errors contract, and ensure tampered receipts return ok: false and status: "INVALID". (files: server.mjs)
• Removed the legacy top-level hash_sha256 from the primary /verify response and exposed proof_hash instead, and moved kid to proof.signature.kid in API surfaces and response values. (files: server.mjs)
• Fixed legacy verifier helper to verify signatures over the expected UTF-8 hash string using Node crypto.verify semantics, and updated smoke test assertions to read the canonical proof.signature.kid. (files: runtime/src/receipt-verification.js, tests/smoke.mjs)

Testing

• Ran npm run check, npm test, and npm run ci locally and all completed successfully in this environment.
• Unit/integration/smoke coverage exercised the changed paths: runtime/tests/runtime-signing.test.mjs, runtime/tests/receipt-verification.test.mjs, runtime/tests/key-rotation.test.mjs, and tests/smoke.mjs all pass after the fixes.
• Files changed: server.mjs, runtime/src/receipt-verification.js, tests/smoke.mjs and commit SHA e0f6705376704d2336cec5e20157ac72d45e6d1a.
• Remaining risk: a small maintenance surface if runtime-core canonical helper APIs change again, but behavior is preserved and covered by the repository's tests.

---

Codex Task