runtime: emit commons receipts with canonical execute entry

[GsCommand]

Motivation

• Commons receipts should reference the real runtime execution surface rather than the payment-gated x402 semantics so they unambiguously represent non-commercial execution.
• Keep commercial x402://... semantics available for payment-aware flows outside this runtime repo while moving commons to a canonical, stable entrypoint.

Description

• Changed the commons receipt model and generation: receipts now include top-level entry, verb, version, and class: "commons" instead of a nested x402 block and use https://runtime.commandlayer.org/execute as the canonical commons entry.
• Updated runtime code to accept execution input, added normalizeExecutionEnvelope, and updated makeReceipt/wrapReceiptResponse to emit the new top-level fields (primary edits in server.mjs).
• Updated built-in receipt schemas, AJV bootstrap, fixtures, smoke/demo scripts, and unit tests to validate and produce the new commons receipt shape (files updated include runtime/tests/runtime-signing.test.mjs, tests/smoke.mjs, scripts/smoke.mjs, tests/fixtures/*, and docs under README.md, docs/OPERATIONS.md, docs/CONFIGURATION.md, SECURITY.md).
• Kept backward-compatible request-side handling for req.body.x402.* where used for trace/actor context, and documented that x402 remains for commercial/payment-aware flows outside this repo.

Testing

• Ran npm test (unit + smoke run) and all tests passed (19/19 tests passed, no failures).
• Regenerated and validated golden fixture with node tests/fixtures/make-golden.mjs and ran node tests/golden.mjs, which succeeded (golden ok).
• Manual smoke/demo script updated and exercised as part of npm test and the smoke execution completed successfully (smoke ok).

---

Codex Task