[Ji-One1]

The buyer tool needs shared contracts so that later layers can separate an agent's report from code-verified storefront state. This PR adds those contracts and the catalog API client, not an executable buyer flow.

What this changes

• Wrap Hydrogen's public Storefront client for tokenless queries. Pass country and language through request-context i18n and let each caller parse response data. There is no extra response-object schema check.
• Define buyer, scenario, checkpoint, cart snapshot, evidence, and result contracts. RunResult.context is directly {country, language}.
• Define CartReadError in src/browser/cart-error.ts, with five codes: unavailable, request-failed, timeout, invalid-response, and unreadable. The reader is not implemented here.
• Define the supported Standard Event names with a private, type-only check against Hydrogen's vendored StandardEventType. Scenarios select which supported events to record.
• Add per-run JSON/JSONL artifact storage, atomic result writes, and TypeScript source-import settings. Reuse Pick<GraphQLFormattedError, "message"> in the legacy validation helper.

Developer impact

Internal tooling only; no Hydrogen public exports change. No changeset is needed.

Risk

Country and language are configured values, not verified browser or effective API context. Artifact serialization preserves values; Error objects retain only name and message. This is not redaction or a guarantee that messages contain no secrets.

Stack: 02/15. Previous: #4308. Next: #4310.

[github-actions]

We detected some changes in packages/*/package.json or packages/*/src, and there are no updates in the .changeset.
If the changes are user-facing and should cause a version bump, run pnpm run changeset add to track your changes and include them in the next release CHANGELOG.
If you are making simple updates to examples or documentation, you do not need to add a changeset.