feat: add Perch Web policy target

[BlaineHeffron]

Summary

• Add the independent perch-web/v1 policy profile for WebMCP and named WIT arguments.
• Add Rust parsing, canonical hashing, BrowserPlan compilation, ServerPlan compilation, and exact call checks.
• Add the matching TypeScript package with Rust and TypeScript parity vectors.
• Add the Site Rescue golden policy and plan fixtures.
• Add CI checks and documentation for the new target.

Security properties

• Bind an HTTPS origin, a component identity, a manifest hash, a principal, an expiry, and a revocation identity.
• Reject missing and additional arguments.
• Enforce exact argument predicates, effects, and approval requirements.
• Keep the BrowserPlan advisory and require an independent ServerPlan check.

Verification

• cargo fmt --all --check
• cargo clippy -p perch-web-ir -p perch-web-compile --all-targets -- -D warnings
• cargo test -p perch-web-ir -p perch-web-compile
• npm run check in packages/perch-web-js
• npm test in packages/perch-web-js

All checks pass locally.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​vitest@​4.1.11

View full report