feat(site): update stack proof demo for production runtime verification

[GsCommand]

Motivation

• Reflect that the production runtime signing proof has been verified and update the public demo to show production-proof behavior.
• Make the trust model explicit so visitors understand that MCP is a bridge, the runtime is the signer, and the verifier performs validation.

Description

• Updated public/stack-proof-demo.html to change wording from local/dev to production runtime verified and to surface the verified proof flow and caveats.
• Added canonical envelope fields showing canonicalization = json.sorted_keys.v1, hash.alg = SHA-256, signature.alg = Ed25519, signature.kid = vC4WbcNoq2znSCiQ, and signer_id = runtime.commandlayer.eth.
• Included explicit proof outcome steps: STEP 1 SIGNED, STEP 2 VERIFIED, and STEP 3 TAMPERED INVALID, and documented expected verification/tamper response fields.
• Added a short "Run the proof" section with the MCP local E2E commands against https://runtime-production-214f.up.railway.app and a warning not to treat the website verifier as production-canonical until /api/verify is validated end-to-end.

Testing

• Ran npm install which completed successfully.
• Ran npm test and all automated tests passed (20 passed, 0 failed).
• Verified the updated file is public/stack-proof-demo.html and renders the updated production-proof content locally.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
commandlayer-commandlayer-org	Ready	Preview, Comment	May 20, 2026 9:24pm
commandlayer-org	Ready	Preview, Comment	May 20, 2026 9:24pm
commandlayer-org111	Ready	Preview, Comment	May 20, 2026 9:24pm