[TheGreatAxios]

Moves read_artifact and write_artifact from the hub into @corbits-builder/tools-artifacts, laid out like tools-design:

• . exports the plain logic: projectArtifacts(capabilities, role, signal) (list, read, write) and documentPart (7000-character parts), so a workflow action can call it without defineTool.
• ./sidecar-bundle exports createArtifactTools(role, { failure, unpackDesign? }), the defineTool bundle. The bundle id stays @corbits-builder/artifacts/tools, so grants are unchanged. The coder role requires unpackDesign.
• The hub keeps and injects failure (logging), as with tools-design.
• HubArtifactReceipt now has one copy, in tools-hub, used by both tools-artifacts and tools-design.

Stacked on #40. Closes CL-11881

Verification

• lint, format:check, typecheck, test (71 pass), pins:verify; packaged.test.ts builds the real workflow bundles.
• Old-vs-new comparison, 130 calls across all five roles through a fake hub (list, versioned and long reads in parts, refusals, writes and dedupe, coder design unpack): results, requests and unpacked files identical.
• Independent review reran an equivalent comparison: byte-identical output. Its doc and layout findings are fixed.

[linear-code]

CL-11881

[corbits-triage]

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

Stacked on #40: only this pull request's own changes were checked.

Notes:

• changes sensitive paths: locks: bun.lock

Triage will approve, request review.

Changed since the last verdict (Fail at e22cb28): 1 new commit.

[corbits-triage]

Triage requests changes:

• Conventions: added code matches a code pattern
• Invented fallbacks: added code matches a code pattern

Nothing triage asked to change still fails, so this request no longer stands.

[TheGreatAxios]

Closing: the decoupling plan on CL-11879 (adopt @corbits/artifacts with Builder rules in its write hook, run-scoped routes, tools that know nothing about projects or tenants) reshapes this package. It will be redone under that plan.