Add designlang public-shell pack; tighten auth capture checks

Ran authenticated extract against coulomb.social; session metadata
matched anonymous Bubble defaults, so treat docs/design-extract as a
public shell baseline (PROVENANCE.md). Capture script now refuses to
overwrite storage-state.json with thin anonymous sessions.

docs/design-extract/components/anatomy.tsx

@@ -0,0 +1,4 @@
+// Auto-generated by designlang — component anatomy v2.
+// Scaffolds. Wire into your token system; not a runtime library.
+
+import * as React from 'react';