CLI runs on Node 20+: npx storebound (bunx keeps working)

- cli/lib/rt.ts: the runtime layer on node: modules (spawn / spawnSync with Bun's defaults, exit codes and
  "Executable not found", which with PATHEXT, sleep, serve, Glob, hasher, gunzip, stdin, SQLite, packageRoot,
  config imports with a type-stripping fallback for Node 20); every Bun.* use in cli/ goes through it
- tools/gen-embedded.ts -> cli/lib/embedded.ts: templates/, cli/shots/*.html and Play's Data safety form embedded
  (replaces Bun text imports; the bundle and the compiled sidecar carry them), checked fresh by bun run ci
- package.json: bin dist/storebound.mjs (Node ESM bundle, tools/build-node.ts, prepack), engines node >=20
- bun run ci: node bundle + node smoke (real node: --version, help, check same as Bun, scan, release plan --help,
  init, MCP handshake + tool call); Forgejo CI sets up Node 20; tests/node-compat.test.ts guards cli/
- install writes npx MCP commands when run with Node; bin/storebound falls back to Node
- docs: npx storebound init (Node 20+) or bunx storebound init

cli/shots/browser.ts

@@ -23,17 +23,18 @@ import { existsSync, readlinkSync } from 'node:fs';
 import { hostname } from 'node:os';
 import { join } from 'node:path';
 import { compiled } from '../lib/runner';
+import * as rt from '../lib/rt';
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 async function chromium(root: string): Promise<any> {
-  for (const base of [root, join(import.meta.dir, '../..')]) {
+  for (const base of [root, rt.packageRoot()]) {
     try {
-      const p = Bun.resolveSync('playwright', base);
+      const p = rt.resolveFrom('playwright', base);
       // only an installed copy (node_modules): outside a project Bun auto-installs the newest playwright into its global
       // cache (~/.bun/install/cache), whose browser build was never downloaded ("headless shell: not installed" on
       // Linux CI, where no Google Chrome hides it); storebound's own copy is next
       if (!isInstalledPackage(p)) continue;
-      return (await import(p)).chromium;
+      return (await rt.importPath(p)).chromium;
     } catch { /* next */ }
   }
   // only reached in the compiled sidecar: the bundled playwright-core (not a runtime dependency of the npm package)
@@ -68,7 +69,7 @@ export interface Candidate {
 }
 
 /**
- * Switches for a Chromium storebound starts itself (Bun.spawn, not Playwright's launch, which already passes
+ * Switches for a Chromium storebound starts itself (rt.spawn, not Playwright's launch, which already passes
  * --no-sandbox unless chromiumSandbox is set): Chromium refuses to run as root on Linux without --no-sandbox
  * ("Running as root without --no-sandbox is not supported", crbug.com/638180), and inside a Docker / Podman container
  * its user-namespace sandbox is usually blocked by seccomp, so CI containers (the Forgejo runner runs jobs as root)