Implement CG-015 staged-download prompt runner

[ysqander]

Motivation

• Add a reproducible prompt-runner to exercise staged-download and setup workflows during detonation (ticket CG-015).
• Provide a deterministic plan builder and execution recording so behavioral telemetry and follow-on tickets can rely on consistent sandbox runs.

Description

• Add a new prompt-runner module packages/detonation/src/prompt-runner.ts that builds deterministic 3–5 prompt plans, extracts inline setup/install commands from SKILL.md, inserts setup-command steps, and executes setup commands inside the prepared detonation sandbox while recording ordered execution records.
• Add unit tests in packages/detonation/src/prompt-runner.test.ts covering bounded prompt selection, prompt deduplication, setup-command extraction from the staged-download fixture, execution-sequence recording, and fallback prompt synthesis.
• Export the prompt-runner API from packages/detonation/src/index.ts so downstream orchestration can call buildPromptRunnerPlan and runPromptRunner.
• Update docs to mark CG-015 complete and adjust the immediate Milestone-B focus toward telemetry/enrichment (CG-016).

Testing

• Ran pnpm build successfully (workspace build completed after changes). ✅
• Ran pnpm typecheck successfully. ✅
• Ran the detonation package tests: pnpm --filter @clawguard/detonation test showed most tests passing, with two runtime-dependent smoke tests failing when no container runtime (Podman/Docker) was available in the environment. ⚠️
• Ran the prompt-runner unit tests directly with node --test packages/detonation/dist/prompt-runner.test.js and they passed. ✅
• Ran full workspace pnpm test; this surfaced an existing unrelated @clawguard/discovery test failure in the repository state, not related to the prompt-runner changes. ⚠️

---

Codex Task