facade/v0 package

untrusted-render: every path Render echoes was read off a crossing frame in Propose (cur.Previous().PkgPath(), which a caller cannot forge or type), and Accept can only promote a key that is already in that tree.

Package facade is the permanent entry point of the "propose and accept" upgrade pattern (pattern F of the exploration; see ../../README.md).

Pattern E lets a deploy take the realm over on the spot. This one splits that into two steps that different people can hold: an implementation realm NOMINATES itself from its own init, and the owner ACCEPTS a package path in a separate transaction. Nothing serves until both have happened.

The split exists because of a mechanical limit, not just a governance preference. An implementation is an interface value, and a wallet cannot put one in a `maketx call` argument: only strings and numbers travel. The original shape of this pattern (the owner hands the facade an object) is therefore reachable only from `maketx run` or from another realm. Proposing from init and accepting by PATH makes both halves ordinary transactions.