W7e: delete the native unit pipeline (.so compile + dlopen execution)

Units now run exclusively on wasm; the native generated-C++ -> clang -> .so ->
dlopen path and its request-time fallback are removed.

- Dispatch (linux_fastcgi.cpp): the 4 handle_complete branches + the CLI-socket
  path route every request through wasm (wasm_ready compiles cold/stale on
  demand); a wasm-unavailable unit now yields a clean error page
  (fail_wasm_unavailable / render_request_failure) instead of native execution.
  compiler_invoke / _cli / _websocket / _serve_http deleted.
- compiler.cpp (-1274): removed the native .so compile (COMPILE_SCRIPT),
  load_shared_unit, dlopen/dlsym/dlclose, compiler_load_shared_unit, and the
  SharedUnit .so function-pointer fields (on_setup/on_render/on_component/
  on_websocket/on_cli/on_once/on_init) in types.h/types.cpp. compile_shared_unit
  now builds only the .wasm side-module; the .uce preprocessor/parser front-end
  is kept (it emits the C++ the wasm compile consumes).
- unit_call()/component()/once/init now resolve across units through the wasm
  host component resolver (uce_host_component_resolve) instead of native dlsym;
  configured runtime error pages render through the wasm backend.
- Dropped the WASM_BACKEND_ENABLED feature flag and dead COMPILE_SCRIPT /
  COMPILE_WASM_UNITS config; unit ABI freshness tied to UCE_UNIT_ABI_VERSION;
  guard against serving a stale .wasm for a deleted source; retired the obsolete
  W5 native-vs-wasm toggle script. Docs updated.

Implemented via the pi agent (with 3 delegated sub-reviews); independently
re-verified on the build host: run_cli_tests --include-wasm-kill => 87 passed,
0 failed, 0 skipped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/cli-test-port-plan.md

@@ -10,7 +10,7 @@ Replace the Python-based network test runner and plugins with UCE unit tests inv
 - [x] UCE CLI tests cover every current Python plugin behavior or explicitly document a deliberate replacement.
 - [x] Existing W5/WASM gates use the UCE CLI test runner instead of `tests/run_network_tests.py`.
 - [x] Python test runner/plugins are deleted after parity validation.
-- [x] Full suite passes on `uce-dev` with `WASM_BACKEND_ENABLED=1`.
+- [x] Full suite passes on `uce-dev` with wasm-only unit execution.
 
 ## Current State
 

docs/wasm-runtime-architecture.md

@@ -1,9 +1,11 @@
 # UCE WASM Runtime Architecture
 
-Status: current as of the W7 cutover (June 2026). This document describes the
-**runtime architecture as built** — the process topology, the wasm membrane,
-the unified request dispatch, and the central WebSocket broker. For the
-historical motivation and the phased migration plan, see
+Status: current as of the W7e native-pipeline removal (June 2026). This document
+describes the **runtime architecture as built** — the process topology, the
+wasm membrane, the unified request dispatch, and the central WebSocket broker.
+Native `.so` unit execution/dlopen fallback has been removed; the parser and
+preprocessor remain only as the front-end that emits C++ for wasm side-module
+compilation. For the historical motivation and the phased migration plan, see
 [`WASM-PROPOSAL.md`](../WASM-PROPOSAL.md); this file is the steady-state
 reference that proposal points at.
 
@@ -116,10 +118,10 @@ __uce_<base>[_<sanitize(suffix)>]
 path and looks up the export's funcref slot; `exists` lets callers probe a unit
 without instantiating it.
 
-`wasm_backend_should_handle(request, entry_unit)` gates whether the wasm path
-takes the request (vs. the legacy native compiler path, still selectable while
-the native pipeline is retired). With `WASM_BACKEND_ENABLED=1` this is the
-default for all unit execution.
+`wasm_backend_should_handle(request, entry_unit)` checks whether the wasm
+backend is initialized and the requested artifact/handler is currently
+available. If an artifact is cold or stale, dispatch compiles it on demand via
+`get_shared_unit()` and rechecks. There is no native unit-execution fallback.
 
 ---
 
@@ -171,9 +173,9 @@ The `UCE_*` params are set by whichever broker forwarded the request:
   `request.resources.websocket_*` and `request.connection` from them before
   invoking `__uce_websocket`.
 
-Each branch has a native-compiler fallback (`compiler_invoke*`) used only when
-`wasm_backend_should_handle` declines — the holdout path during native
-retirement.
+If a unit still cannot be served after the on-demand wasm compile, the worker
+returns a clean 500 with the wasm/compile error; it does not execute native unit
+code.
 
 ---
 
@@ -294,7 +296,6 @@ header free-functions are `inline`. The wasm backend exposes only declarations
 
 | Key | Default | Meaning |
 |---|---|---|
-| `WASM_BACKEND_ENABLED` | `1` | Route unit execution through the wasm path. |
 | `WASM_BACKEND_VERBOSE` | `0` | Emit `X-UCE-Wasm-*` workspace timing headers (benchmark only). |
 | `FCGI_SOCKET_PATH` | `/run/uce.sock` | Worker pool FastCGI socket (brokers forward here). |
 | `CLI_SOCKET_PATH` | `/run/uce/cli.sock` | Worker CLI socket. |
@@ -308,7 +309,7 @@ header free-functions are `inline`. The wasm backend exposes only declarations
 
 - **Regression gate**: `scripts/run_cli_tests.sh --include-wasm-kill` runs the
   in-runtime CLI suite (`site/tests/cli_runner.uce`) plus the site test pages.
-  Current baseline: **86 passed, 0 failed**.
+  Current baseline: **87 passed, 0 failed**.
 - **WebSocket end-to-end**: a headless client performs a raw WS handshake to
   `:HTTP_PORT` with path `/site/tests/websockets.ws.uce` (self-resolving
   `SCRIPT_FILENAME`) and asserts the `hello-ack` frame — exercising the full