feat(canvas): add focused command discovery and editor domain operations

[smackgg]

Command discovery currently emits about 7 MB of schemas, making it difficult to find a command or its accepted parameters. This change makes canvas command list a 6,775-byte index of 47 commands and lets callers expand only the operation, node kind, or schema path they need with describe. Discovery responses use schema_version: 2; consumers of the previous embedded schemas should request the explicit full-schema output. Five on-demand guides explain prompt references, storyboard boundaries, time units, Scene3D, and Timeline.

The bundled Canvas runtime now supports Scene3D's 21 operations, Timeline's 38 operations, and shared XML prompt-reference handling. It also validates move deltas and child permutations before mutation, corrects the cover no-op schema, compares checkpoint JSON semantically, and preserves a text track recreated with the same ID in one Timeline batch. The CJS, license notices, and checksums are updated together from SDK source commit 2dfe29a254b2f559188dfdbe2cf2479c26024cc9.

Root, Canvas, and installer help work without authentication or installation side effects, including Windows backup files. Packaging includes the discovery and guide modules; CI runs the compiled operation suites and help checks across Node 16/20 on Linux and Windows.

Validation:

• Complete npm test passed locally, including Go tests and vet; package dry run and runtime checksum validation passed.
• Pull request CI passed all five jobs on head e69f9d2b79d45abe86078d3b487ef15be957a249, including Node 16/20 on Linux/Windows and Go tests/vet.
• Compiled runtime: 43 basic commands / 92 scenarios, 21 Scene3D operations / 6 boundaries, and 38 Timeline operations / 7 boundaries passed.
• Real CLI service checks passed for basic Canvas flows, 17 Scene3D operations / 6 boundaries, 38 Timeline operations / 5 public boundaries, and the same-batch text-track recreation regression. These used task-specific test canvases and independent readback.
• Four motion-clip operations passed locally but lack a public CLI import path for real-service prerequisites. Browser presentation and media generation/export were not validated.

Runtime SHA-256: 19661847115778622c6fbfc8c02e8d4c958d4f5f7729d56d51f5c8008e780028. This PR prepares the CLI and runtime for review; it does not publish a package or release.