Convert LoadInput.init to Effect + extract InstanceBootstrap as a Service

[kitlangton]

Summary

• `LoadInput.init` switches from `() => Promise` to `Effect.Effect<void, never, R>`. The `R` is generic and propagates through `load`/`reload`/`provide` so callers can pass Effect-native init bodies without ceremony.
• `InstanceBootstrap` is restructured from a top-level `Effect` const into a `Service` with `.run` on its interface. Tests can swap a fake `InstanceBootstrap.Service` layer; production wiring composes the default via `InstanceBootstrap.defaultLayer`.
• Production callers (HttpApi instance-context middleware, project handler) drop `() => AppRuntime.runPromise(InstanceBootstrap)` and pass `bootstrap.run` directly via `yield* InstanceBootstrap.Service`.

Cycle break

`containsPath` moves from the `Instance` namespace into `instance-context.ts` (alongside `InstanceContext`). The signature now requires an explicit `InstanceContext` (was implicitly via ALS). Five callers updated. This unlocks dropping `Instance` value imports in a few places (e.g. `file/index.ts`, `tool/external-directory.ts`, `tool/bash.ts`).

Why

`init: () => AppRuntime.runPromise(InstanceBootstrap)` was pure ceremony at every production call site — wrap an Effect in a thunk so the store can `await` it, then `Effect.promise()` it back into an Effect. Pointless round-trip in code that's otherwise moving to Effect-native.

Compatibility shim

Legacy `Instance.provide({init: () => Promise})` keeps working via a small Promise→Effect bridge in `instance.ts` (`liftLegacyInput`). About 70 test sites still pass Promise-style init for setup (env vars, file writes); a follow-up PR will migrate those and drop the bridge.

Tests

• `bun run test test/project/instance.test.ts test/server/httpapi-instance-context.test.ts test/file/path-traversal.test.ts` — 30/30 pass
• `bun run typecheck` — clean

Followups noted

1. Migrate ~70 test sites from `init: () => Promise` to Effect-style; drop `liftLegacyInput`.
2. Bake `InstanceBootstrap.Service` into `InstanceStore` as default init so production callers don't pass it. Requires breaking the `Config → Instance → InstanceStore → bootstrap → Config` runtime cycle (move `Config.update` dispose responsibility to caller, etc).