Share portable catalog sync core

[jackyor]

What changed

• add Worker-safe @hk-open-data/core/portable and hk-open-data/portable entry points
• share TypeScript catalog record normalization across SQLite and D1 consumers
• automatically refresh stale local CLI catalogs with a 24-hour threshold
• fix metadata-only versus document-aware search-index compatibility
• remove the local Effect source bootstrap

Why

The public package is the reusable source of truth for both the local CLI and the private Cloudflare MCP service. The portable entry keeps Bun SQLite at the local edge while allowing the same schemas, Effect services, sync engine, and provenance logic to run in Workers.

Verification

• 42 Bun tests
• TypeScript typecheck
• oxlint
• package build and npm dry-pack
• Python compile checks and four search-index tests

The package remains at 0.0.0 and is not published.