initial code (#2)

* feat: initial code port from hyperframes-internal

Port all OSS-ready packages from the internal monorepo:
- @hyperframes/core — shared types, HTML generation, GSAP utilities, runtime
- @hyperframes/cli — CLI for creating, previewing, and rendering compositions
- @hyperframes/engine — framework-agnostic rendering engine (BeginFrame + FFmpeg)
- @hyperframes/producer — video rendering pipeline (Puppeteer + FFmpeg)
- @hyperframes/ui-player — browser-based video player component
- @hyperframes/studio — composition editor (React frontend + Hono backend)

Includes regression test suite with Docker-based test harness.

All HeyGen-internal references, deployment infrastructure, and
proprietary assets have been removed. Package names migrated
from @app/* to @hyperframes/*.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: scrub internal codenames and stale references from OSS port

- Replace static.heygen.ai runtime URLs in test fixtures
- Remove internal CDN publish script (publish-hyperframe-runtime.ts)
- Replace sandbox-studio, sandbox-interceptor, __magicEditRuntime
  with neutral names (studio, hyperframe-runtime, __hyperframeRuntime)
- Fix stale Vault API / localhost references in docs
- Remove broken deprecated_studio link

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: remove remaining internal codenames and stale references

- Delete stale producer README.md and PIPELINE.md (referenced nonexistent files)
- Replace "Cerberus" codename with "HyperFrames" in test design reviews
- Replace magic-edit postMessage identifiers with hf-preview/hf-parent
- Rename debug-magic-edit-timeline.ts to debug-timeline.ts
- Replace "Motion Cut" with "HyperFrames" in Timeline comments
- Fix studio/CLI references to nonexistent archive package
  (use local data/projects/ dir, stub render proxy)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/core/src/runtime/README.md

@@ -0,0 +1,58 @@
+# Hyperframe Runtime Engine
+
+This folder owns the runtime that powers preview and producer parity.
+
+## Current Direction
+
+- Runtime source of truth is converging on `hyperframe.ts`.
+- Build produces:
+  - `dist/hyperframe.runtime.iife.js` (browser bootstrap)
+  - `dist/hyperframe.runtime.mjs` (tooling/tests)
+  - `dist/hyperframe.manifest.json` (version + sha256 + artifact map)
+- FE owns iframe runtime injection.
+- BE persists raw generated HTML without injecting runtime scripts.
+- Producer validates pinned runtime checksum from manifest before render.
+
+## Runtime Contract (Stable Surface)
+
+Globals:
+
+- `window.__player`
+- `window.__playerReady`
+- `window.__renderReady`
+- `window.__timelines`
+- `window.__clipManifest`
+
+postMessage:
+
+- parent -> runtime control:
+  - `source: "hf-parent"`
+  - `type: "control"`
+  - actions: `play`, `pause`, `seek`, `set-muted`, `set-playback-rate`, `enable-pick-mode`, `disable-pick-mode`
+- runtime -> parent events:
+  - `source: "hf-preview"`
+  - `type: "state"` and `type: "timeline"`
+
+Determinism baseline:
+
+- `renderSeek` is the producer-canonical seek path.
+- 30fps quantization and readiness gates are correctness requirements.
+
+## Build
+
+```bash
+pnpm -C core build:hyperframes-runtime
+```
+
+## Security Expectations
+
+- Runtime bootstrap URL must be version-pinned and host-allowlisted.
+- Iframe bridge payloads must be schema-validated.
+- Unsafe URL schemes (`javascript:` and unapproved `data:`) are rejected.
+- Fail closed if runtime bootstrap/handshake is not healthy.
+
+## Product Editing Model
+
+- Primary mode: prompt + element picking.
+- Secondary mode: manual precision controls.
+- Avoid timeline-first manual workflows as default product path.