Move the browser host out of the demo and take only the half ceangal owns

[O6lvl4]

Stacked on #1 — review that first.

ceangal's browser host lived in examples/demo/, so every consumer copied it out of an example. That is how a downstream copy diverged from this repo and the rendering bug in #1 got found and fixed in the copy rather than here. Worse, the copy also contained snaidhm's gpu namespace implementation: a repo that merely consumes snaidhm owned the only copy of snaidhm's own host.

What moves

examples/demo/{ceangal_runtime.js,sdf.js,ttf.js,*.wgsl,font.ttf} → host/, with the runtime renamed runtime.js.

The gpu namespace implementation is removed from this repo entirely. It belongs to snaidhm, which declares it (almide-graphics/snaidhm#3 ships it as snaidhm/host/gpu.js), and runtime.js now imports ./gpu.js from there. What is left here is the half ceangal actually owns: the frame loop, the DOM overlay, fonts, and ceangal's own shaders.

GPU and DOM handles were sharing one table. They are now separate spaces — the wasm side never crosses them, so they never needed to share — and everything GPU-side goes through the host object snaidhm returns.

The demo becomes a consumer

examples/demo/ keeps index.html and its own assets; the host files are assembled into it and gitignored. So the demo exercises exactly the path a real consumer takes, instead of being the place the source happens to live.

Assembling

The toolchain resolves .almd modules from dependencies but has no equivalent for web host assets — native/ is native-only and hardcoded — so a page still copies these files. tools/assemble-host.mjs makes that copy mechanical and checkable rather than manual:

node tools/assemble-host.mjs examples/demo host ../snaidhm/host
node tools/assemble-host.mjs --check examples/demo host ../snaidhm/host   # for CI

Each package lists its contribution in host/MANIFEST. The assembler writes .provenance recording the source commit and hash of every file:

runtime.js       ceangal@7622175 5584070ccb5d1052
gpu.js           snaidhm@9fc865f 4f87cc9537d60782
...

--check fails on drift in either direction, and also on a served file that no package claims — the fork-waiting-to-happen case. Verified falsifiable: appending a line to an assembled runtime.js produces

· runtime.js differs from ceangal (7622175) — the served copy has drifted

and exit 1.

What this does not fix

Consumers still copy. npm (git dependencies work) would version the copy but not remove it, because runtime.js fetches ./raster.wgsl and ./font.ttf relative to the page — those have to land in the served directory either way. With two consumers, ownership plus a drift guard is the part that was actually costing something. A third consumer is the point to revisit packaging.