Create a Workers runtime skeleton and Node dependency guard

[yhay81]

Outcome

Prove that provider-neutral HayaSend core code compiles for Cloudflare Workers before implementing Cloudflare adapters.

Scope

• Workers runtime entrypoint and dependency boundary
• compile-time guard against Node-only imports in domain services
• Web Crypto, streams, and fetch-compatible abstractions where required
• capability declaration that clearly says Cloudflare is not yet production-ready

Acceptance criteria

• the core compiles in the Workers runtime
• CI fails on forbidden Node-only dependency paths
• AWS runtime behavior remains unchanged
• no Cloudflare production claim is added

Depends on recipient summaries and recovery diagnostics.
Parent direction: #81
Execution plan: #84

[yhay81]

Implementation and exact-main evidence complete.

• PR Add Cloudflare Workers portability skeleton #115 merged through protected main with squash commit ebbf5ab0aaed4a8794a71f3276f52ddf28ec2285.
• Workers skeleton is explicitly non-production: only /healthz and /capabilities; production_ready: false; email API and all Cloudflare adapters remain disabled.
• The provider-neutral core compiles for Workers, generated Wrangler types are checked, and CI now fails on forbidden Node/AWS/runtime imports. The current AWS/CLI package excludes the experimental Workers entrypoint.
• PR-head validation passed: 40 test files / 364 tests, Workers typecheck and Wrangler dry-run (11.20 KiB / 4.18 KiB gzip), conformance/build/SAM/Lambda loading, npm package/install/CLI gate, Docker, gitleaks, npm audit 0, and current dependency check.
• Exact-main CI run 30269993272, CodeQL run 30269992779, and Project site run 30269993333 passed on the same commit. Open code-scanning alerts on main: 0.
• Exact-main AWS integration run 30270547594 passed in dedicated account hayainc-test (330599756148, ap-northeast-1) with retain_stack=false. It deployed hayasend-it-30270547594-1, proved legacy log-group adoption, exercised the deployed API, and proved durable outbox recovery.
• Cleanup passed: CloudFormation reported Deleted successfully; the workflow removed/verified the payload bucket, table, schedule resources, and managed/legacy log groups, and rejected any residual stack or log group.

Acceptance criteria for #101 are satisfied. Next sequential item: #102.