Fix strict-security env and function runtime grants

[wolfy-j]

Summary

• Register env.storage.router directly with the central env registry before publishing the StorageRegister event.
• Decode and apply security: declared on Lua function and bytecode-function configs at execution time.
• Preserve ambient actors and merge declared function policies into the existing scope instead of replacing caller context.

Why

Kickside exposed two runtime-level contract gaps during strict-security boot:

1. Router-backed env variables can be materialized in the same boot pass as the router storage. Before this change, the composite manager only published an async registration event, so dependent env.variable entries could observe storage not found and fail permanently depending on event ordering.
2. Packages such as wippy.facade, wippy.views, and app public-login handlers already declare runtime policies on function.lua entries. Upstream runtime decoded no security field for Lua funcs, so those handlers ran without their declared policies. The result was empty facade config, public.js failures, and login-path failures under the strict model.

Together these make package-declared runtime security deterministic without app-level hardcoded grants.

Compatibility

• Existing StorageRegister event is still emitted unchanged.
• The manager-local router storage cache is unchanged.
• env.storage.router now matches the synchronous registration behavior of file, memory, os, and static env storage managers.
• Function security: is additive for existing apps: entries without it behave as before.
• Policy-only function configs preserve the ambient actor and merge into existing scope, so user-owned calls do not lose caller identity.

Tests

• go test ./service/env/... ./system/env/...
• go test ./runtime/lua/component/function ./system/security
• go test ./api/env ./api/runtime/lua ./runtime/lua/component/function ./service/env/... ./system/env/... ./system/security ./boot/components/env/...
• go test ./runtime/lua/modules/process ./system/contract
• go test ./...
• make build-wippy-local

Kickside smoke was validated with the PR-built binary:

• GET /api/public/facade/config returned populated facade/env values.
• GET /api/public/env/public.js returned populated JS env.
• GET / returned 200.
• GET /app/login.html returned 200.
• Bad login returned 401 Invalid credentials instead of the previous nil-db 500.