feat!: promote provider-neutral v2 kernel

[developer-1px]

Summary

• replace the package root with a provider-neutral v2 Kernel: exactly 8 runtime values, 12 public types, and a non-generic six-member JSONDocument
• add pure JSON Patch Protocol and stateful Projection semantics for immutable ownership, atomic probe/commit parity, acceptance, canonical publication, and reentrant delivery
• move the Zod-based rich editing runtime to the Candidate ./session entrypoint, keep React as a Candidate Session adapter, and make React/Zod peers optional
• migrate official extensions, labs, and repository consumers to the explicit Session boundary
• add the versioned v2 profile, public-surface manifest, machine-readable Protocol/Projection vectors, black-box suites, exact signature/package checks, docs, and release gates
• use owned structural sharing for Projection commits and guard the 50k-document leaf-commit path with a performance budget

Breaking change

Backward compatibility is intentionally not preserved because the package has not had a stable v2 release. The portable root is the small Kernel contract. @interactive-os/json-document/session is a separate Candidate surface and is not promised to be a subtype of the root Projection.

Validation

• npm run release:check
  • core: 43 files, 552 passed, 4 skipped
  • v2 standard: 3 files, 37 passed
  • 19 official extensions and 41 lab extensions: typecheck, test, build, import smoke
  • all apps: typecheck, test, production build
  • docs/site evaluation and 5 Playwright browser scenarios
  • adapter and core performance budgets
  • publish tarball smoke for 2.0.0-rc.0
• clean staged-tree validation also covered the locally deleted legacy apps/workbench without including those deletions in this PR
• 50k leaf commit p50: 4.08ms in the release check, under the 30ms regression budget