CLI runs on Node 20+: npx storebound (bunx keeps working)

- cli/lib/rt.ts: the runtime layer on node: modules (spawn / spawnSync with Bun's defaults, exit codes and
  "Executable not found", which with PATHEXT, sleep, serve, Glob, hasher, gunzip, stdin, SQLite, packageRoot,
  config imports with a type-stripping fallback for Node 20); every Bun.* use in cli/ goes through it
- tools/gen-embedded.ts -> cli/lib/embedded.ts: templates/, cli/shots/*.html and Play's Data safety form embedded
  (replaces Bun text imports; the bundle and the compiled sidecar carry them), checked fresh by bun run ci
- package.json: bin dist/storebound.mjs (Node ESM bundle, tools/build-node.ts, prepack), engines node >=20
- bun run ci: node bundle + node smoke (real node: --version, help, check same as Bun, scan, release plan --help,
  init, MCP handshake + tool call); Forgejo CI sets up Node 20; tests/node-compat.test.ts guards cli/
- install writes npx MCP commands when run with Node; bin/storebound falls back to Node
- docs: npx storebound init (Node 20+) or bunx storebound init

cli/desktop.ts

@@ -13,6 +13,7 @@ import type { Args } from './lib/args';
 import { CONFIG_NAMES } from './lib/config';
 import { BUNDLE_ID, DOWNLOAD_LABEL, type Download, type DownloadKey, downloadsDir, downloadsFor, findInstalled, MANIFEST, type Manifest, manifestProblems, openCommand, openFolderLink, PAGE, PUBLIC_KEY } from './lib/desktop-dist';
 import { verify } from './lib/minisign';
+import * as rt from './lib/rt';
 
 type Fetch = (url: string) => Promise<Response>;
 
@@ -61,7 +62,7 @@ export async function run(args: Args): Promise<void> {
     const link = isApp ? openFolderLink(dir) : null;
     const cmd = openCommand(platform, installed, link);
     if (args.has('json')) { console.log(JSON.stringify({ installed, link, command: cmd }, null, 2)); return; }
-    const p = Bun.spawn(cmd, { stdio: ['ignore', 'ignore', 'pipe'] });
+    const p = rt.spawn(cmd, { stdio: ['ignore', 'ignore', 'pipe'] });
     if (platform === 'darwin') {
       const code = await p.exited;
       if (code !== 0) throw new Error(`open -b ${BUNDLE_ID} failed: ${(await new Response(p.stderr).text()).trim()}`);