fix(cli): snapshot resolves runtime from own dist, not monorepo layout

The snapshot command resolved the HyperFrames runtime IIFE via a
relative path that walked up three directories to packages/core/dist/.
This only worked in the monorepo dev layout — npm/npx installs have
a flat dist/ folder with cli.js and the runtime side by side.

Without the runtime, window.__player was never created and the
snapshot fell back to seeking every __timelines entry to the same
absolute time. Sub-composition timelines expect relative time
(offset from their data-start), so all beats rendered beat-1 content.

Fix: resolve("hyperframe.runtime.iife.js") from __dirname (the dist/
folder itself), where the build already copies the runtime IIFE.

packages/cli/src/commands/snapshot.ts

@@ -102,16 +102,11 @@ async function captureSnapshots(
   // 1. Bundle
   let html = await bundleToSingleHtml(projectDir);
 
-  // Inject local runtime if available
-  const runtimePath = resolve(
-    __dirname,
-    "..",
-    "..",
-    "..",
-    "core",
-    "dist",
-    "hyperframe.runtime.iife.js",
-  );
+  // Inject local runtime if available.
+  // The runtime IIFE is copied into the CLI dist during build (build:runtime),
+  // so it lives alongside cli.js. The old ../../../core/dist/ path only worked
+  // in the monorepo dev layout and broke for published/npx installs.
+  const runtimePath = resolve(__dirname, "hyperframe.runtime.iife.js");
   if (existsSync(runtimePath)) {
     const runtimeSource = readFileSync(runtimePath, "utf-8");
     html = html.replace(