tool: slim Deno wrapper surface

[PerishCode]

Summary

• Shrinks the public Rust @tool surface to the current product atoms:
  github and cloudflare.
• Moves generic wrapper helper behavior into repo-local Deno modules under
  .runseal/lib/std/ and updates wrappers to import helpers directly.
• Adds Deno wrapper import-map/lock support and documents the Deno-first wrapper
  boundary.
• Polishes docs and progressive help for the retained tool surface.

Operator impact

• Wrapper authors should use Deno helper imports such as
  @/lib/std/json.ts instead of old generic @tool json-style helpers.
• Public @tool discovery now shows only GitHub and Cloudflare helpers.
• Cloudflare DNS record list/create and GitHub PR check probing now have
  progressive --help output.
• Manager help now documents the supported release source and install path
  options.

Validation

• Full commit hook / runseal :guard passed for 11faf6b.
• Branch beta workflow succeeded for v0.9.0-beta.1:
  https://github.com/PerishCode/runseal/actions/runs/28164933177
• Installed beta local closed-loop validation passed for runseal v0.9.0-beta.1.
• Full commit hook / runseal :guard passed again for docs/help commit
  32fb007.

Note: the published beta artifact corresponds to 11faf6b; the follow-up
docs/help commit is pushed on this PR branch and validated locally by the full
guard.