feat: initial Go/JS/Rust Origin check-in client SDKs

Standalone clients that resolve a machine unique ID (OS machine ID first,
falling back to a generated UUID persisted to disk), detect hostname/IP/
container/orchestrator, and register+re-ping origin.warky.dev's public
service-checkin endpoint on a daily interval. Ported from icy2's internal
origincheckin package but extended to the full check-in contract and made
dependency-light for external reuse.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

js/README.md

@@ -0,0 +1,47 @@
+# @warkanum/origin-client (JS/TS)
+
+```
+npm install @warkanum/origin-client
+```
+
+Node >=18, ESM only.
+
+## Usage
+
+```ts
+import { OriginClient } from "@warkanum/origin-client";
+
+const client = new OriginClient({
+  serviceKey: "...",
+  type: "myservice",
+  version: "1.2.3",
+  name: "myservice-nova",
+});
+
+client.start(); // immediate check-in, then every 24h until stop()
+```
+
+Call `client.checkinOnce()` directly instead of `start()` to send a single
+check-in and observe the result/error.
+
+## Config
+
+| Field | Required | Default |
+|---|---|---|
+| `serviceKey` | yes | — |
+| `type`, `version`, `name` | yes | — |
+| `url` | no | `DEFAULT_URL` (`https://origin.warky.dev/api/public/service-checkin`) |
+| `appType` | no | `"javascript"` |
+| `hostname` | no | OS hostname |
+| `containerId` | no | best-effort Docker/cgroup detection |
+| `orchestrator` | no | best-effort Kubernetes/Docker detection |
+| `installId` | no | OS machine ID, else a generated UUID persisted to `installIdPath` |
+| `intervalHours` | no | `DEFAULT_INTERVAL_HOURS` (24) |
+| `logger` | no | discards warnings |
+
+`site`, `environment`, `databaseType`, `databaseName`, `port`, `baseUrl`,
+`internalUrl`, `description` are optional metadata with no default.
+
+`hostname()`, `outboundIp()`, `containerId()`, `orchestrator()`, and
+`resolveMachineId()` are exported standalone for callers that want the
+detection logic without the HTTP client.