Add opt-in runtime identity context

[RobLe3]

Summary

• add the canonical bounded runtime-identity formatter and exact message-composition rules
• expose explicit/required modes while keeping the default disabled
• pin the shared fixture and reuse effective-capability identifiers for optional facts
• integrate only with browser chat; non-chat and existing disabled behavior remain unchanged

Evidence

• npm test: 51 passed
• typecheck, build, package provenance and dry-run package audit passed

Security and compatibility

The capsule exposes only explicitly supplied bounded facts. It is not an authentication or prompt-injection boundary. No package was published or deployed.

Closes #13