feat: add governed dynamic host operations

[calltelemetry-jason]

Summary

• add declarative dynamic host-operation aliases and parent-process capability providers
• keep adapters out of workerData while supplying immutable run, parent-run, and pinned bundle provenance
• persist started/completed receipts for completed replay and dangling-start reconciliation with a stable idempotency key
• fail closed for undeclared/unavailable capabilities and non-JSON requests/results
• bind sorted alias-to-capability mappings into manual approval scope and display them in the approval prompt

Verification

• npm run typecheck
• npm run check:public-surface
• npm run test:build >/dev/null && node --test test/unit/dynamic-host-operations.test.mjs (8 passed)
• adjacent dynamic runtime suite: 147 passed; its one initial failure was the missing dist precondition, then npm run build plus that exact built-dist test passed 1/1
• independent exact-head Codex review: CLEAN

This change is merged in the CallTelemetry fork as calltelemetry#1 at merge commit 3884618e12174f9ecea178f120d29849b16f3000. No npm package was published.