[TheGreatAxios]

Adds @corbits-builder/tools-hub, the shared base for Builder's tool packages, laid out like Interchange's tools-mail with one entry point.

• workflowHttpJson, mediatedHttpJson and WorkflowHttpError moved from the hub unchanged.
• resolveWorkflowProjectScope moved unchanged.
• projectScopeCode is the pure half of projectScopeFailure: it picks the code the model sees. The hub keeps only the logging.
• The hub imports from the package; no copies remain. Tool names, inputs, outputs and grants are unchanged.
• README, plus the package tables in docs/DEV.md and docs/IMPLEMENTATION.md and the release version list in CONTRIBUTING.md.

Closes CL-11879

Verification

• format:check, lint, typecheck, test (71 pass).
• apps/hub/src/workflows/packaged.test.ts builds the real workflow bundles against the package (3 pass).
• Independent review; its findings (half-moved helper, layout, docs) are fixed.

[linear-code]

CL-11879

[corbits-triage]

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

Notes:

• changes sensitive paths: locks: bun.lock

Triage will approve, request review.

[TheGreatAxios]

Closing: tools should not know the hub's project routing, so a tools-hub package is not needed. Plan on CL-11879: documents move to @corbits/artifacts' own run-scoped tools, the remaining hub calls become run-scoped routes, and tool config is filled in at bundle time.