feat(cli): add serve command for local metadata probes

[nucleuskit]

Summary

• Add nucleus serve as a first-class CLI command for local service metadata probes.
• Serve metadata-only endpoints for /healthz, /readyz, and /.well-known/nucleus.json, with --check support for non-listening preflight output.
• Wire the command through the root CLI, add focused serve/root tests, and document the command in README and concept docs.
• Move root command tests away from the removed example/hello-http fixture by generating stable temporary service fixtures, and add new examples/* reference material for agent, deploy, service, worker, and library workflows.
• Advance the bridge and cap submodule pointers to their capability updates already merged upstream.

Motivation

nucleus describe, validate, lint, and verify already produce machine-readable evidence, but local runtime probes still lacked a small, predictable endpoint surface that agents and humans can inspect before wiring business handlers or provider SDKs. serve fills that gap with a loopback-first metadata server and a --check mode suitable for automation preflight.

The command intentionally stays inside the CLI orchestration boundary: it reads service metadata and exposes evidence, but it does not auto-wire provider bridges, start generated business handlers, or introduce runtime defaults outside explicit user intent.

Affected Areas

• CLI: new nucleus serve command under cmd/nucleus/internal/serve.
• CLI output contract: additive serve.v1 JSON envelope with result_kind, schema_version, schema_ref, ok, mode, summary, diagnostics, and server fields.
• Root command wiring and tests: cmd/nucleus/internal/root now uses generated temporary service fixtures instead of the deleted example/hello-http tree.
• Docs/examples: README, docs/concepts/serve-command.md, kernel concept docs, and new examples/* references.
• Submodules: bridge and cap pointers move to their latest capability commits; contract is unchanged in this root diff.

Compatibility

This is an additive CLI feature. Existing commands and manifests are not changed. The server defaults to loopback (127.0.0.1:8080), rejects non-local bind addresses unless --allow-non-local is explicit, and --check does not open a listener.

The new JSON schema reference is introduced as contract/schema/serve.schema.json; reviewers should treat the exact field names as the new compatibility surface before this command is released.

Validation

Clean detached worktree from origin/feat/serve-command at 5cc047b:

rtk go test ./...
# Go test: 133 passed in 18 packages

rtk go test ./... -race -count=1
# Go test: 133 passed in 18 packages

gofmt -l cmd/nucleus/internal/root cmd/nucleus/internal/serve
# no output

Generated service smoke path:

rtk go run ./cmd/nucleus --dir "$service" init --name serve-smoke --module example.com/serve-smoke --template service --agent codex --json
rtk go run ./cmd/nucleus --dir "$service" serve --check --json
# ok=true, mode=check, schema_version=serve.v1, endpoint_count=1, generated_fresh=true

rtk go run ./cmd/nucleus validate --dir "$service"
# OK validated: nucleus.yaml, api/openapi.yaml, api/errors.yaml; diagnostics: 0 errors, 0 warnings

rtk go run ./cmd/nucleus lint --dir "$service"
# OK linted: nucleus.yaml, core imports, runtime imports, top-level directories; findings: 0

rtk go run ./cmd/nucleus verify --dir "$service" --json
# ok=true, steps=7, passed=7, failed=0

Compare scope:

gh api repos/nucleuskit/nucleus/compare/main...feat/serve-command
# ahead_by=1, behind_by=0, files=50

Review Notes / Residual Risks

• Repo-root validate/lint/verify --dir . is not meaningful evidence because the Nucleus repository root is not a service directory and has no root nucleus.yaml; this PR validates a generated service instead.
• The local main worktree currently has dirty nested module checkouts in core, runtime/grpc, runtime/http, runtime/worker, and a checked-out contract commit that is not part of this root branch. Validation was run in a clean detached worktree to avoid mixing those local states into this PR.
• Long-running listener behavior is covered by command/server tests; the manual smoke above uses --check so the command can terminate in CI-friendly fashion.