CLI runs on Node 20+: npx storebound (bunx keeps working)

- cli/lib/rt.ts: the runtime layer on node: modules (spawn / spawnSync with Bun's defaults, exit codes and
  "Executable not found", which with PATHEXT, sleep, serve, Glob, hasher, gunzip, stdin, SQLite, packageRoot,
  config imports with a type-stripping fallback for Node 20); every Bun.* use in cli/ goes through it
- tools/gen-embedded.ts -> cli/lib/embedded.ts: templates/, cli/shots/*.html and Play's Data safety form embedded
  (replaces Bun text imports; the bundle and the compiled sidecar carry them), checked fresh by bun run ci
- package.json: bin dist/storebound.mjs (Node ESM bundle, tools/build-node.ts, prepack), engines node >=20
- bun run ci: node bundle + node smoke (real node: --version, help, check same as Bun, scan, release plan --help,
  init, MCP handshake + tool call); Forgejo CI sets up Node 20; tests/node-compat.test.ts guards cli/
- install writes npx MCP commands when run with Node; bin/storebound falls back to Node
- docs: npx storebound init (Node 20+) or bunx storebound init

tests/do-it-dont-ask.test.ts

@@ -78,7 +78,9 @@ describe("first rule: do it, don't ask", () => {
     /\bto check yourself\b/i,
   ];
   const cliFiles = (dir: string): string[] => readdirSync(join(root, dir), { withFileTypes: true }).flatMap(e =>
-    e.isDirectory() ? (e.name === 'data' ? [] : cliFiles(`${dir}/${e.name}`)) : e.name.endsWith('.ts') ? [`${dir}/${e.name}`] : []);
+    e.isDirectory() ? (e.name === 'data' ? [] : cliFiles(`${dir}/${e.name}`))
+      // lib/embedded.ts is generated from templates/ (the owner's own files, not CLI output), like data/
+      : e.name.endsWith('.ts') && `${dir}/${e.name}` !== 'cli/lib/embedded.ts' ? [`${dir}/${e.name}`] : []);
 
   test('CLI output never hands agent work to the owner', () => {
     const hits: string[] = [];