Guard runtime from Puter identity state

[heznpc]

Summary

• Strengthens runtime file checks so AcademyLens cannot reference Puter globals, Puter AI, or Puter app/auth identity keys.
• Adds a runtime-policy test that scans manifest and runtime source files for the same contamination paths.
• Updates the AI review bridge notes to document the new guard.

Verification

• npm ci
• npm run check:files
• npm test -- tests/runtime-policy.test.js tests/ai-review-bridge.test.js
• npm run lint
• npm run format:check