Add webhook auto-verify showcase page with live demo

[GsCommand]

Motivation

• Provide a public, working showcase for automatic receipt verification that demonstrates runtime-sign -> verifier-validate -> tamper-reject end-to-end, and can be used as the public example for examples/webhook-auto-verify.
• Preserve the existing light ENS/Stripe visual direction and canonical site nav/footer while keeping no changes to API routes or schemas.

Description

• Added a new page public/webhook-auto-verify.html containing the required hero, webhook explanation, backend commands, trust-boundary guidance, cards, and grouped footer consistent with site styling.
• Implemented a plain-browser JavaScript live demo that posts to https://runtime.commandlayer.org/trust-verification/sign/v1.0.0 to generate a receipt, posts receipts to https://runtime.commandlayer.org/verify to auto-verify, and performs an in-page tamper (mutating receipt.result.payload.message) then re-verifies to show rejection; loading states and TRANSPORT_ERROR handling are included and no success is faked.
• The demo extracts response.receipt with fallback to response.final_receipt, only marks VERIFIED when data.ok === true or data.status === 'VALID'|'VERIFIED', and surfaces metadata.proof fields (canonicalization, hash.alg, signature.alg, signature.kid, signer_id) plus compact raw JSON.
• Added links to /webhook-auto-verify.html from public/ambient-verification.html, public/api.html, public/docs.html, public/verify.html, and public/stack-proof-demo.html and adjusted those footers to include the demo page.

Testing

• Ran npm install at repo root which completed successfully in this environment.
• Ran npm test at repo root which failed due to missing test fixture /examples/sample-receipt.json (two tests errored), unrelated to the new page.
• In examples/webhook-auto-verify: ran npm install and npm run check, where npm run check passed in this environment.
• Attempted npm run generate:samples in the example which failed with DNS resolution error (getaddrinfo EAI_AGAIN runtime.commandlayer.org) in this environment, so sample generation could not complete here.
• npm run build is not present in the root package.json so no site build was run.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
commandlayer-commandlayer-org	Ready	Preview, Comment	May 21, 2026 9:14pm
commandlayer-org	Ready	Preview, Comment	May 21, 2026 9:14pm
commandlayer-org111	Ready	Preview, Comment	May 21, 2026 9:14pm