One error classification and renderer for the http client on native, embedded and p3 (ADR-0023 steps 0 and 2)

[O6lvl4]

Part of #2659. Implements ADR-0023 step 0 (the contracts, landed in almide/als#113 and pinned here) and step 2 (the error classification).

Step 0

• proofs/als-pin.txt → 3c5b9f2, in its own commit.
• C-328, C-330, C-366 and C-367 reworded, and C-370 (header refusal) added. The statements mirror the judge byte for byte (check-als-pin.sh OK).

Step 2

• New crates/almide-rt-core/src/http_error_core.rs holds the one table of classes and texts, plus http_quote. Native and the embedded host render from it: URL parse, header check, dial, TLS, read/write, size cap, framing, and the call handle's transport errors. No text carries an OS errno. Native's wording changes once, as §4.2 accepts. rt-core also refuses the nine managed header names (C-370).
• New crates/almide-wasm-run/src/wasi_p3_http_err.rs: the p3 shim lays the same pieces out as data. It adds $http_quote (a byte-for-byte twin), $http_err, $http_hdr_check and $http_env_num.
  • Maps each wasi:http error-code case onto a class by name.
  • Checks the scheme's three invalid-URL reasons itself, and the framed family's headers before any resource exists.
  • Sends ALMIDE_HTTP_TIMEOUT_SECS as request options and enforces ALMIDE_HTTP_MAX_RESPONSE_BYTES on the body.
  • Passes internal-error(some(msg)) through as msg.
  • The static (p3 transport) text now remains only for the bring-up stop knob.

Evidence

• tests/http_error_class_cross_test.rs runs on native, embedded (almide run --target wasm) and p3 (wasmtime run -S http=y), comparing stdout, stderr and exit code. It covers two cases:
  • spec/embedded_cross/http_error_classes.almd: the scheme reasons, the escapes, and a closed port.
  • spec/embedded_cross/http_header_refusal.almd: bad names and values, and the managed names.
  • Local servers: a stalled server (timeout), a plain-TCP server under https (tls), and a 100 KB response over a 1000-byte limit (too-large).
• The rt-core audit and call-handle tests are updated to the new texts, with added forbidden-name and quote tests.
• docs/stdlib/http.md gains the class table.
• The check and AST manifests are regenerated (own commit, develop's # oracle: header kept). The alloc and size ledgers are untouched: neither the core emitter nor the stdlib changed.

Not covered by fixtures

• DNS needs the network.
• On p3, authority-level URL reasons (host, port) read as the unclassified HTTP-request-URI-invalid text until the stdlib parser (step 6).