refactor(js-exec): port JavaScript runtime to run (#394)

* refactor(js-exec): port JavaScript runtime to run

Replace js-exec's custom QuickJS worker implementation with the run package while preserving its Node-compatible sandbox APIs.

- add a run-based adapter for filesystem, fetch, tools, child processes, TypeScript, ESM, Buffer, output limits, and cancellation
- remove the bespoke js-exec worker, SharedArrayBuffer lifecycle, generated artifact, and worker-specific tests
- adopt run's hardened worker pool, resource limits, stack format, and concurrency model
- replace quickjs-emscripten with run@2.0.3 and allow-list the package from the minimum release-age policy
- raise the minimum Node.js version to 22.13
- update build configuration, bundler guidance, package docs, and security tests

Validation:
- 277 js-exec and security tests
- TypeScript typecheck
- banned-pattern checks
- knip
- worker synchronization check
- package build
- 17 distribution and package-content tests

* fix-build

* refactor(js-exec): use synchronous run bindings

* fix(js-exec): address run adapter review

* fix(js-exec): harden run adapter boundaries

* fix(js-exec): bound runtime bridge resources

* fix(js-exec): preserve guest boundary contracts

* fix(js-exec): close runtime compatibility gaps

* fix(js-exec): restore runtime boundary defaults

* fix(js-exec): use explicit run source type

* fix(js-exec): address runtime boundary feedback

* fix(js-exec): preserve runtime limit compatibility

* fix(js-exec): close remaining runtime boundary gaps

* chore(build): remove unused minimatch external