feat: add toolbox contract shell and testkit

packages/testkit/README.md

@@ -0,0 +1,17 @@
+# @add-ideas/toolbox-testkit
+
+Validate and smoke-check a built toolbox application:
+
+```sh
+toolbox-check dist
+```
+
+The checker validates `toolbox-app.json`, its id and SemVer version, verifies
+the entry, icon, and declared assets, rejects unsafe local paths, serves the
+build under a deep nested prefix, and fetches it both standalone and with
+`?toolbox=/toolbox.catalog.json`. It also fetches local scripts, stylesheets,
+images, icons, linked web manifests, and their icons from the entry HTML, so
+root-absolute references fail the nested-deployment check. It does not launch a
+browser.
+
+The same behavior is available programmatically as `checkToolboxDist()`.