feat: replace JavaScript compatibility routes with checked TypeScript

[fffonion]

Summary

• Replace JavaScript compatibility routes with a strictly checked TypeScript subset for .ts and .mts; reject .js/.mjs/.cjs entries and imported dependencies. Preserve Lua and native RSS.
• Keep TypeScript parsing, binding, type/declaration rules and formatting in compat. Use the generic linked checked pipeline from Core PR #33, pinned exactly to d8c21caf8f91a8e5ceaffa10ea0b1473cdd4f43b with a Cargo-generated lock.
• Carry typed host, named/generic/optional/callable schemas through scripts, analysis, hints and VM execution. Validate even unused declare function signatures against catalog-owned named-type origin, preserving explicit host aliases and strict ABI/resource admission.
• Correct signed numeric boundary lowering and release input quoting; restrict artifact-writing permission to a tag-only job after lint/tests and all matrix builds.
• Use equivalent key-based field sorting accepted by rolling-stable Clippy, preserving the original lexical order and stable/unstable sorting choices.

Verification

Exact clean candidate: 2f7ba39692bb7523a9eb769535de48efd339a7f4.

• Parent independently verified the latest test-only portability correction, all 40 committed files, 6 current-source and 7 new clean final-HEAD raw gates. Two test fixture constructors prefer assigned TMPDIR and use the platform temporary directory when it is absent. All production, lockfile and test assertion bytes remain unchanged from the prior head. Formatting, module/optional suites, serial workspace and all-target/all-feature Clippy with -D warnings pass.
• The preceding equivalent sorting correction retained lexical order and original sorting strategies, and passed actual Rust 1.99 Clippy on GitHub. Its prior test failure exposed the fixture TMPDIR assumption; the latest head must pass the real no-TMPDIR CI environment.
• Final workspace: 84 unique Rust business tests plus one separately counted helper, retaining all prior business identities. Focused test counts: host 10, hints 4, type 4, optional 6; these reruns are not added to the workspace total.
• Source baseline 263806cb independently passed 42 current-source and 44 clean final-HEAD gates, source-bound declaration rejection RED/GREEN, release build, CLI/VMBC, provenance and Python release/workflow tests 7/7. Those receipts remain baseline evidence, not fresh full-matrix receipts for this correction.
• Wrong-origin unused declarations reject in compile/analyze/hints, including nested array alias; malformed guest-to-host calls reject before effects and valid explicit host aliases run. P2 closure was independently confirmed against the exact baseline; the latest two sorting substitutions leave its implementation and tests unchanged.
• Exact-head GitHub Actions now pass on Rust 1.99: push run 38242259121 and PR run 38242263460, 8 executed jobs successful and 2 tag-only asset jobs correctly skipped. Both Rust job logs report 13 harnesses, 85 passes (84 business plus one helper), zero failures/ignored/filtered. Format, Clippy, tests, CLI positive/negative acceptance and Linux/macOS/Windows builds/smoke all succeed; the genuine no-TMPDIR CI environment validates the fixture fallback.

Evidence limits

A compatible published Core registry version remains a separate release prerequisite with registry build/test/dry-run gates. Native Git-pin checks do not establish wasm guest execution or real tag publication.

Same-file explicit host alias plus a guest type with the catalog original spelling remains rejected by the existing duplicate-type admission; independent guest same-name and valid host-alias controls pass separately. Existing COV-01 and PERF-01 advisories remain nonblocking.

[fffonion]

Local consumer acceptance at 800ced8

• Exact Core SDK pin: ef09b3f4925b1dcb39fb44420b050e631a954290 for pd-vm, pd-host-function and transitive pd-host-schema, with maintained locked provenance checks.
• Two scoped commits preserve history: dependency/provenance repin and minimal TypeScript throw-statement result consumption with maintained native regressions.
• Byte-unchanged TheAlgorithms/TypeScript factorial.ts at upstream 19b4ced86c99815f142d4a46a028f55487b8038a: real imported invocation returns 720 for 6 with SSA/native count29. Actual Node v26.7.0 validates all9 cases (4returns,5exact errors). Native retained VMs prove counters for the error routes; writer/companion/source-deleted standalone fresh-process routes preserve results and errors.
• All8 source-bound current-HEAD local gates pass. Workspace default parallel and serial:166passed/0failed/0ignored each (165business+1helper), identical target-qualified identities; array22 and12source-certified owner controls remain intact. Formatting, all-target check, strict Clippy and test compilation preflight pass.
• Independent combined spec/quality review accepted this exact consumer scope with no blocking findings. Preserve its non-blocking maintenance suggestions; its original CLEAN label accompanied advisories and is normalized to NOT CLEAN/advisory-only under our review convention.

This acceptance covers the scalar native consumer. Source CLI/artifact capture authority, indirect capture-cell lifecycle controls, production collection/quotas/cost, transparent arrays and generators remain separately gated. Whole plan is still in progress. Exact-head push CI 38434621064 and pull-request CI 38434625554 completed successfully at 800ced8ff8a7fa0422ba3cc052b12dfa85d2676a. Across both runs, Rust acceptance and Linux/macOS/Windows CLI build/smoke jobs total8 successes;2 tag-only release-assets jobs were expected skips and are not counted as successes. Remote branch and PR head were read back at that exact commit. This scalar native consumer scope is delivered; whole-plan follow-up remains in progress.