wasm runtime: central WS broker, unified handlers, W7d holdouts, membrane completeness

- WS: a dedicated broker process owns HTTP_PORT + every connection; it forwards
  renders to the worker pool over uce.sock (non-blocking) and applies ws_*
  command batches flushed back at workspace teardown. Removes the now-dead
  per-worker websocket executor (-509 lines).
- Dispatch: unify CLI / WebSocket / serve_http / page render through one
  serve_via_wasm(entry_unit, handler) path; handler string -> __uce_<handler>
  export symbol.
- W7d: rewrite zip.uce to the membrane return-value error contract (no C++
  try/catch), error-reporting.uce to genuine wasm traps instead of throw, and
  sharedunit.uce to unit_info(); empty the native-only token gate.
- Membrane: wire ls / mkdir / file_mtime through new uce_host_file_list /
  uce_host_file_mkdir / uce_host_file_mtime hostcalls (resolve_guest_file gains
  directory support). Fixes /doc/index.uce listing nothing; adds a regression
  assertion that the index enumerates items.
- Docs: add docs/wasm-runtime-architecture.md; record the W7e staged native-
  deletion plan in WASM-PROPOSAL.md.

Verified: scripts/run_cli_tests.sh --include-wasm-kill -> 87 passed, 0 failed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

site/demo/error-reporting.uce

@@ -1,5 +1,13 @@
 #include "demo_guard.h"
 
+// Fault-injection demo. Under the wasm runtime every unit fault is a guest
+// trap that the workspace turns into a clean 500 without harming the worker;
+// these modes exercise the three distinct trap causes (mirrors tests/wasm-kill).
+u64 error_reporting_recurse(volatile u64 depth)
+{
+	volatile u64 next = depth + 1;
+	return(next + error_reporting_recurse(next));
+}
 
 RENDER(Request& context)
 {
@@ -10,12 +18,19 @@ RENDER(Request& context)
 	}
 	String mode = context.get["mode"];
 
-	if(mode == "exception")
-		throw std::runtime_error("Intentional test exception from /test/error-reporting.uce");
-	if(mode == "abort")
-		raise(SIGABRT);
-	if(mode == "segfault")
-		raise(SIGSEGV);
+	if(mode == "trap")
+		__builtin_trap();
+	if(mode == "recurse")
+	{
+		volatile u64 sink = error_reporting_recurse(0);
+		(void)sink;
+	}
+	if(mode == "loop")
+	{
+		volatile u64 i = 0;
+		while(i >= 0)
+			i++;
+	}
 
 	<>
 		<link rel="stylesheet" href='style.css?v=<?= time() ?>'></link>
@@ -23,11 +38,11 @@ RENDER(Request& context)
 			<a href="index.uce">UCE Test</a>:
 			Error reporting
 		</h1>
-		<p>These actions intentionally trigger failures so you can verify that UCE returns a usable `500` response instead of dropping the upstream connection.</p>
+		<p>These actions intentionally trigger guest traps so you can verify that UCE returns a usable `500` response from a healthy worker instead of dropping the upstream connection.</p>
 		<ul>
-			<li><a href="?mode=exception">Trigger uncaught exception</a></li>
-			<li><a href="?mode=abort">Trigger SIGABRT</a></li>
-			<li><a href="?mode=segfault">Trigger SIGSEGV</a></li>
+			<li><a href="?mode=trap">Trigger an explicit trap (`__builtin_trap`)</a></li>
+			<li><a href="?mode=recurse">Trigger stack exhaustion (unbounded recursion)</a></li>
+			<li><a href="?mode=loop">Trigger a runaway loop (epoch interrupt)</a></li>
 		</ul>
 	</>
 }