CLI runs on Node 20+: npx storebound (bunx keeps working)

- cli/lib/rt.ts: the runtime layer on node: modules (spawn / spawnSync with Bun's defaults, exit codes and
  "Executable not found", which with PATHEXT, sleep, serve, Glob, hasher, gunzip, stdin, SQLite, packageRoot,
  config imports with a type-stripping fallback for Node 20); every Bun.* use in cli/ goes through it
- tools/gen-embedded.ts -> cli/lib/embedded.ts: templates/, cli/shots/*.html and Play's Data safety form embedded
  (replaces Bun text imports; the bundle and the compiled sidecar carry them), checked fresh by bun run ci
- package.json: bin dist/storebound.mjs (Node ESM bundle, tools/build-node.ts, prepack), engines node >=20
- bun run ci: node bundle + node smoke (real node: --version, help, check same as Bun, scan, release plan --help,
  init, MCP handshake + tool call); Forgejo CI sets up Node 20; tests/node-compat.test.ts guards cli/
- install writes npx MCP commands when run with Node; bin/storebound falls back to Node
- docs: npx storebound init (Node 20+) or bunx storebound init

cli/ads/client.ts

@@ -9,6 +9,7 @@ import { createPrivateKey, type KeyObject } from 'node:crypto';
 import { credentialValue, inline } from '../lib/credentials';
 import { ADS_API, adsHeaders, type AdsCreds, clientSecret, type J, TOKEN_URL, tokenForm } from '../lib/apple-ads';
 import { errorBody } from '../lib/http';
+import * as rt from '../lib/rt';
 
 export const CRED_NAMES = ['APPLE_ADS_CLIENT_ID', 'APPLE_ADS_TEAM_ID', 'APPLE_ADS_KEY_ID', 'APPLE_ADS_PRIVATE_KEY'] as const;
 
@@ -34,7 +35,7 @@ export function adsClient(root: string, o: { sleep?: (ms: number) => Promise<unk
   const c = adsCreds(root);
   let key: KeyObject;
   try { key = createPrivateKey(c.pem); } catch { throw new Error('APPLE_ADS_PRIVATE_KEY is not a valid EC private key (PEM)'); }
-  const sleep = o.sleep ?? ((ms: number) => Bun.sleep(ms));
+  const sleep = o.sleep ?? ((ms: number) => rt.sleep(ms));
   let cached = { token: '', until: 0 };
 
   async function token(): Promise<string> {