cultnet-ts: add an idunn-runtime subpath export that does not load dgram

`cultnet-ts/idunn-runtime` exposes the signer and loader alone. Web apps import
it instead of the package root, which also carries the Odin publisher and
node:dgram. The root export is unchanged. Test loads both under a stubbed
dgram: the subpath loads, the root fails.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

packages/cultnet-ts/package.json

@@ -15,6 +15,11 @@
       "require": "./dist/contracts.js",
       "default": "./dist/contracts.js"
     },
+    "./idunn-runtime": {
+      "types": "./dist/idunn-runtime-authority.d.ts",
+      "require": "./dist/idunn-runtime-authority.js",
+      "default": "./dist/idunn-runtime-authority.js"
+    },
     "./authority": {
       "types": "./dist/cultmesh-authority.d.ts",
       "require": "./dist/cultmesh-authority.js",

packages/cultnet-ts/test/idunn-runtime-authority.test.ts

@@ -1,5 +1,6 @@
 import { test, type TestContext } from "node:test";
 import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
 import dgram from "node:dgram";
 import fs from "node:fs";
 import path from "node:path";
@@ -363,3 +364,26 @@ test("the loaded authority is frozen: the bind, contract, Expected, Activation a
   const signer = createIdunnRuntimeSigner({ authority, capabilities: loaded.capabilities });
   assert.equal(presenceSlot(signer.answerRouteObservation(CHALLENGE), RUNTIME_PRESENCE_SLOT.boundEndpoint), loaded.candidate);
 });
+
+// A web app must be able to import the signer without pulling the Odin publisher and dgram.
+function loadUnderDgramStub(modulePath: string): string {
+  const script = [
+    'const Module = require("node:module");',
+    "const load = Module._load;",
+    'Module._load = function (request, ...rest) { if (request === "dgram" || request === "node:dgram") throw new Error("dgram was loaded"); return load.call(this, request, ...rest); };',
+    "try { require(process.argv[1]); process.stdout.write(\"loaded\"); } catch (error) { process.stdout.write(\"failed: \" + error.message); }",
+  ].join("\n");
+  const run = spawnSync(process.execPath, ["-e", script, modulePath], { encoding: "utf8" });
+  assert.equal(run.status, 0, run.stderr);
+  return run.stdout;
+}
+
+test("the idunn-runtime subpath loads the signer and loader without loading dgram; the package root does load it", () => {
+  const subpath = require.resolve("cultnet-ts/idunn-runtime");
+  assert.equal(loadUnderDgramStub(subpath), "loaded");
+  assert.equal(loadUnderDgramStub(require.resolve("cultnet-ts")), "failed: dgram was loaded");
+  const exported = require(subpath) as Record<string, unknown>;
+  assert.equal(typeof exported.createIdunnRuntimeSigner, "function");
+  assert.equal(typeof exported.loadIdunnRuntimeAuthorityFromEnvironment, "function");
+  assert.equal(exported.createIdunnRuntimePresencePublisher, undefined);
+});