Scaffold airlock + verified-run primitive

[ThomasHartDev]

sets up the repo from scratch: strict typescript, tsup build, vitest, and a CI workflow, plus the actual primitive this whole thing is built around. runVerified takes some untrusted task, runs it under a deadline with an AbortSignal, and only hands back the value when it beats the clock and passes a post-condition assertion the caller supplies. everything else (timeout, failed assertion, thrown error) comes back as an explicit variant of a discriminated union so you literally can't read the output without proving the run was good first. the in-process tier here can't preempt a synchronous spin loop, that's what the isolated-vm and docker tiers will handle later, but this pins down the contract they'll implement. tests cover the ok path, assertion refusal, timeouts aborting the task, caller cancellation, bad timeout args and a few concurrent runs staying independent.