test: prove generated Nutrition API over external HTTP

[artiphishle]

Closes #295

Summary

• generate the released Nutrition template through the real Studio ProjectManager pipeline;
• assert the generated manifest preserves exactly one canonical nutrition API in infra.apis[];
• execute the Products repeat binding through released @ankhorage/runtime/bindings and @ankhorage/data-sources with an observable fetch boundary;
• prove products.list becomes GET https://api.ankhorage.com/v1/nutrition/products?limit=50&offset=0;
• read the generated scanner barcodeScanned binding and prove products.getByBarcode becomes GET https://api.ankhorage.com/v1/nutrition/products/by-barcode/:barcode through the same canonical API and released Runtime executor;
• prove Studio operation testing resolves the same canonical manifest API to the same external request path;
• prove Nutrition API transport never resolves to localhost, PostgREST, nutrition_products, or generated database paths;
• assert the generated root runtime uses createRuntimeApiOperationExecutor and contains no Supabase DB API wiring;
• require released @ankhorage/runtime ^2.1.0 for the headless owner entrypoint.

Scope

This is the API Phase-1 acceptance proof only. It adds no internal API generation, Fastify/server generation, persistence generation, or compatibility path.

Changeset

Patch: Studio now requires Runtime 2.1+ so the acceptance path can consume the public headless @ankhorage/runtime/bindings owner entrypoint.

Validation

Green on the final head: build, repository Doctor, lint with zero warnings, format, Knip, Bun tests including generated Nutrition Products and barcode API acceptance, Studio web smoke, generated-app web E2E, typecheck, and changeset status.

[artiphishle]

API7 test reached the canonical Runtime boundary and exposed a release-safe dependency: @ankhorage/runtime@2.0.0 only exposes binding/API execution through its root, which also loads React Native in a headless Bun test. Runtime PR ankhorage/runtime#23 adds the public headless @ankhorage/runtime/bindings entrypoint and is fully green. This Studio PR remains draft until Runtime is merged/released; then it will consume the released subpath rather than deep-importing or copying Runtime internals.