SDK: export a public TOON decoder (sdk/testing) so extension tests can parse host-rendered output without deep imports or a duplicated @toon-format/toon pin #1462

Problem

Extension packages render through the host, so TOON is their default output, and their acceptance tests need to assert on what the host actually printed. The public SDK (@unbrained/pm-cli/sdk, /sdk/testing, /sdk/core, …) exposes no TOON decoder: there is no decodeToon, parseToon or equivalent. Authors fall back to one of three bad options:

1. Hard-coding quoting, as in assert.match(out, /status: "open"/). This broke when the host renderer started emitting unquoted scalars (feat: revalidate live GitHub blockers without unblocking items pm-github#115 CI went red after a toolchain bump).
2. Deep-importing internals: import { decodeToonItemContent } from "@unbrained/pm-cli/dist/core/item/toon-decode.js". This sits outside the exports map and can break on any release.
3. Adding @toon-format/toon as a devDependency pinned to whatever pm-cli uses internally (4.1.1 today). That duplicates the pin, and any skew means the test parser disagrees with the host renderer.

Proposal

• Export decodeToon(text) (and ideally encodeToon(value)) from @unbrained/pm-cli/sdk/testing, or from /sdk, backed by exactly the TOON implementation the host renders with.
• In the authoring docs, recommend asserting host output as decodeToon(stdout) rather than by string matching.
• Optional: createExtensionTestHarness gives a run(...) result exposing .parsed for both --json and TOON output.

That makes extension tests independent of quoting and whitespace changes in the renderer, and removes a reason to reach into dist/.