feat(code-mode): replace Self with QuickJS

[Astro-Han]

Summary

Replace the hand-written Self interpreter with @ai-sdk/code-mode and its QuickJS sandbox.

• keep one public executeCodeCell path and one process-wide worker
• serialize cells through a cancelable single-slot FIFO queue while preserving nested tool concurrency inside a cell
• replace interpreter-specific limits with enforceable timeout, memory, stack, source, bridge, and JSON byte limits
• remove the old interpreter plus its Acorn and direct TypeScript dependencies
• align the AI SDK provider family and include the embedded QuickJS licenses in desktop notices

This reduces the production execution core from a 2,429-line custom interpreter to a 127-line adapter and delegates JavaScript/TypeScript semantics and sandbox maintenance to the upstream library.

Verification

• npm ci
• npm run test --workspace @maka/code-mode — 31 tests passed
• npm run build --workspace @maka/core
• npm run build --workspace @maka/runtime
• node --test packages/runtime/dist/__tests__/code-mode-backend.test.js — 20 tests passed
• npm run check:third-party-notices
• Biome format check for all changed TypeScript files
• git diff --check main...HEAD

Repository-wide tests were not run locally; CI owns full coverage.

Adversarial review

Four deep reviews covered architecture, concurrency/lifecycle, resource security, and test/dependency maintenance. Findings addressed in this draft:

• fatal durable failures now abort the invocation, block later dispatch, drain concurrent siblings, and preserve the first failure
• tool lookup uses a null-prototype set so inherited properties cannot become untracked host tools
• explicit undefined limit overrides retain Maka's stricter defaults
• error classification uses structured upstream codes and distinguishes byte limits from serialization/tool failures
• the sandbox deadline is named honestly; aborted host operations still drain before the cell and FIFO slot settle
• embedded QuickJS license inventory fails closed for every unreviewed @ai-sdk/code-mode version
• redundant and brittle tests were removed or rewritten; concurrency tests use deterministic barriers

Remaining upstream constraints: @ai-sdk/code-mode emits Node's one-time stripTypeScriptTypes experimental warning, and its tools proxy reserves the exact property name then (no current production tool uses it).

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No