feat: resolve runtime bindings through canonical APIs

[artiphishle]

Closes #19

Summary

• resolve operation bindings by apiId + endpointId + operationId from canonical APIs;
• source app APIs from manifest.infra.apis[] in RuntimeScreen;
• delegate API execution to released @ankhorage/data-sources@^2.0.0 through testEndpoint();
• replace the public data-source operation executor with createRuntimeApiOperationExecutor();
• remove the API/data-source database shortcut and generated CRUD database executor;
• preserve explicit database actions such as db.persist as a separate runtime capability;
• use API-scoped diagnostics (apiId) for API binding failures.

Required invariant

BindingOperationRef
  apiId
  endpointId
  operationId
→ manifest.infra.apis[]
→ Runtime API selection
→ @ankhorage/data-sources
→ HTTP

API operation bindings must never route through a database adapter.

Phase 1 boundary

External API execution only. origin: internal remains explicitly unsupported by Data Sources. No API generation, server generation, persistence mapping, Fastify, or deployment behavior is introduced here.

Validation still in progress

• migrate remaining Runtime tests/fixtures to Contracts v8 API identities;
• prove Nutrition resolves to https://api.ankhorage.com/v1/nutrition/products;
• prove an API binding cannot invoke a DB adapter while explicit db.persist remains independent;
• update the Bun lockfile for Contracts v8 / Data Sources v2;
• pass build, lint, format, Knip, tests, typecheck, and Changesets before marking ready.