runtime: drive stores from coalesced scheduling events

[lannbot]

Summary

Cycle 2 of the scheduler redesign following #371: replace competing async drivers, Promise races, arrival signals, settlement keepers, and per-stream pumps with coalesced event-driven store service.

• Host settlements and actual scheduler transitions request service; outstanding Promises and retained host capabilities are not resident drivers.
• One permission predicate controls ordinary scheduling, including nested synchronous entry and admission housekeeping. Dispatch one settled tail at a time and recheck live execution, pending claims, and unqueued engine hops before continuing.
• Separate service requests from actual progress notifications. Hop admission wakes after both tail completion and confirmed genuine suspension, including across fairness handoffs.
• Share a persistent bounded work budget between the synchronous ordinary prefix and asynchronous drain. Yield to platform tasks without changing canonical direct-call/sync-lift behavior or stopping post-result guest work.
• Retire coordinator observations on call completion/failure; retain host capabilities solely as deadlock-suppression evidence.
• Replace obsolete driver-mechanism tests with behavioral regressions for batched settlements, pending claims, nested entry, pre-/post-result fairness, admission, and cleanup.

Test adaptation changes:

• A dedicated same-store gated-future fixture establishes the rejected pre-return transfer. Successful transfer is observed explicitly rather than treating an unrelated call or gate release as a publication fence; existing convention goldens remain unchanged.
• Future disposal tests observe actual poison before their first read and require PeerTrappedError.
• The bounded Wasmtime worker writes its complete result before explicitly exiting: one upstream test intentionally leaves infinite background guest work. Runtime execution is not stopped to make the subprocess exit.
• Update one exact classified Wasmtime failure message (future-read:65), retaining its runtime-semantics classification. Clean baseline comparison confirms the same pre-existing deadlock gap.

Verification

• Independent adversarial review cleared the final implementation and test corrections. New genuine-park admission regression demonstrated red with only its progress notification disabled and green after restoration.
• Final just gates < /dev/null passed in full, log /tmp/opencode/scheduler-cycle2-final-gates.log.
• Runtime: 1014 passed, 0 failed, 3 existing ignored. WASI: 305 passed / 1 optional ignored. ct-runner: 24 passed / 1 optional ignored.
• Official conformance: 1285 passed commands, 0 unexpected failures, 126 xfail, 95 pending-runtime, 5 unsupported directives. Seeded pass count 1282 with existing profile exclusions.
• Supplementary Wasmtime FIFO and seed runs match clean bcc71c9 exactly: 88 files / 850 commands; 515 passes, 157 classified failures, 4 skips, 174 excluded commands; zero unexpected results and infrastructure failures. This is not all-pass conformance.
• Public Wasmtime guest tests: 3 passed under FIFO and 3 under seed 1 (concurrent calls, controlled settlements, resource short reads).
• SpiderMonkey/Node shell gates passed; Bun findings-only lane matched expectations. JSC shell remains unavailable on arm64. Chromium/Firefox page/worker/shared-worker conformance and OPFS gates passed.
• TLS/C0 consumer smokes passed; C0 legs 3–4 are translation coverage, TLS retains existing not-applicable cases. Consumer trees unchanged before/after verification.
• Corrected convention test passed 30 repeated invocations across default/seed1/seed4242; independent final reruns passed.

No public protocol, manifests, golden transcripts, official conformance xfails, or browser overlays changed. Automerge will be armed and watched through delivery.