feat: rename to BitGate and close the drop-in gap

Renames the project and makes it as easy to adopt as BitLogin, which was the
stated bar and which it did not previously meet.

Rename (ADR 0005): @nostr-governance/* -> @bitgate/*, governance-* elements ->
bitgate-*, createGovernanceRuntime -> createBitGate. "Governance" reads as DAO
voting to this audience and named a category rather than a product; BitGate
names the benefit and joins the bit- family that BitVid and BitRoad compose
with. Domain types keep their names — the product is BitGate, the subject
matter is still governance. The migration plan is left as written; this ADR
records the change rather than rewriting history.

Drop-in distribution (ADR 0006): adopting BitGate meant supplying a transport,
authoring a policy, and wiring every element in JavaScript. Now:

- createRelayTransport(urls) — WebSocket transport with reconnection, backoff,
  subscription replay, and cross-relay dedupe
- policy presets (social, commerce, admin-only) addressable by name; the engine
  still carries no thresholds of its own
- <bitgate-provider> — configuration in markup, with descendants finding the
  runtime through a bubbling context event rather than DOM walking, which
  breaks across shadow boundaries
- npm run build:widget — a self-contained dist/bitgate.js

That last one came from running it in a browser rather than from a test. Bare
specifiers resolve in Node and vitest but not in a browser, so the widget
source worked everywhere except a plain static page — the one place it exists
to serve. The bundle is not committed: consumers build from reviewed source.

Also found by running it: the provider's ready event fires during element
upgrade, before a page that defines elements after parsing can attach a
listener, so it now exposes `ready` as a promise too.

Four bugs fixed along the way, three found by new tests and one by the browser:
admin state stayed silent when a roster change altered capabilities but no
denials; the relay transport sent every subscription twice on connect; the
commerce preset computed a meaningless visibility verdict at checkout and could
hide a listing from its own seller; <bitgate-status> threw on an unusable
decision.

759 tests; lint, typecheck, and both builds clean.

examples/commerce/test/proof-of-fit.test.js

@@ -6,7 +6,7 @@
 
 import { describe, expect, it } from "vitest";
 
-import { createCommands, createGovernanceRuntime, createMemoryTransport } from "@nostr-governance/runtime";
+import { createCommands, createBitGate, createMemoryTransport } from "@bitgate/runtime";
 
 import { COMMERCE_POLICY, COMMERCE_ROLE_CAPABILITIES } from "../src/policy.js";
 import { productAdapter, reviewAdapter, sellerAdapter } from "../src/adapters.js";
@@ -57,7 +57,7 @@ const RIVAL_PRODUCT = {
 };
 
 function setup({ allowlisted = [SELLER, OTHER_SELLER] } = {}) {
-  const runtime = createGovernanceRuntime({
+  const runtime = createBitGate({
     applicationId: "commerce-example",
     namespace: "commerce",
     transport: createMemoryTransport(),
@@ -298,7 +298,7 @@ describe("7. moderator capability checks", () => {
   });
 
   function commandsAs(pubkey) {
-    const runtime = createGovernanceRuntime({
+    const runtime = createBitGate({
       applicationId: "commerce-example",
       namespace: "commerce",
       transport: createMemoryTransport(),
@@ -462,7 +462,7 @@ describe("10. no core changes required", () => {
     // Every import in this example resolves through a package entry point; if
     // one reached into a package's internals, the reference guard and this
     // assertion are what would catch it.
-    const core = await import("@nostr-governance/core");
+    const core = await import("@bitgate/core");
     for (const name of [
       "createApplicationAdapter",
       "evaluateObject",