feat(relay-run): Phase 0 single-host relay — real data-plane wiring + integration test

New relay-run/ package boots the REAL term-relay relay-node between a browser WSS
listener and an agent mTLS listener, delegating every authz verdict to the real
relay-auth onUpgrade (Origin/CSWSH + capability verify + DPoP PoP + single-use jti),
with the real P4 E2E crypto. No audited package modified.

- P1 (done): in-process integration test round-trips a sealed payload both ways
  through the real createRelayNode splice + real createMuxSession; INV2 asserted
  (relay sees only ciphertext); negative controls (foreign Origin / missing DPoP -> 401).
- P2 (boots): main.ts brings up self-signed TLS + 3 listeners + in-memory control-plane.
- P3 (not landed): no agent dial / node-pty / relay-web serve yet.
- 4 tests green, tsc clean. node_modules via symlinks (gitignored).

Two real seam drifts surfaced (documented in PLAN_RELAY_RUN_PHASE0, not hacked):
(1) term-relay authz-port DpopContext shape vs relay-auth — reconciled (server-derived htu/htm);
(2) control-plane CapabilityVerifier.verify is sync but relay-auth verify is async — blocks
    HTTP account/pairing seeding until a 1-line async widen.

relay-run/tests/smoke.test.ts

@@ -0,0 +1,29 @@
+import { describe, it, expect } from 'vitest'
+// Cross-package resolution smoke test: prove relay-run can bare-import the REAL exports of the
+// relay packages it wires — including the term-relay data-plane DEEP imports (term-relay has no
+// barrel index / exports map, so subpath `.js` specifiers resolve to the `.ts` sources).
+import { onUpgrade, onReattach, issueCapabilityToken, configureVerifyKey } from 'relay-auth'
+import { createClientHandshake, createHostHandshake, createE2ESession } from 'relay-e2e'
+import { APP_SUBPROTOCOL, encodeTokenSubprotocol } from 'relay-contracts'
+import { createRelayNode } from 'term-relay/data-plane/relay-node.js'
+import { createAgentListener } from 'term-relay/data-plane/agent-listener.js'
+import { authorizeUpgrade } from 'term-relay/data-plane/upgrade.js'
+import { createMuxSession } from 'term-relay/mux/mux-session.js'
+
+describe('relay-run cross-package import smoke', () => {
+  it('resolves relay-auth / relay-e2e / relay-contracts + term-relay data-plane deep imports', () => {
+    expect(typeof onUpgrade).toBe('function')
+    expect(typeof onReattach).toBe('function')
+    expect(typeof issueCapabilityToken).toBe('function')
+    expect(typeof configureVerifyKey).toBe('function')
+    expect(typeof createClientHandshake).toBe('function')
+    expect(typeof createHostHandshake).toBe('function')
+    expect(typeof createE2ESession).toBe('function')
+    expect(APP_SUBPROTOCOL).toBe('term.relay.v1')
+    expect(typeof encodeTokenSubprotocol).toBe('function')
+    expect(typeof createRelayNode).toBe('function')
+    expect(typeof createAgentListener).toBe('function')
+    expect(typeof authorizeUpgrade).toBe('function')
+    expect(typeof createMuxSession).toBe('function')
+  })
+})