feat(timer): add the standard timer host module

Add the self-contained timer host-function module with
`timer::{at,every,pending_count,running_count}`, the `TimerBackend` contract,
`TimerConfig`/`TimerRegistration` admission limits, and the `TimerExtension`
composition/install entry point.

The module owns callback ownership transfer, the private callback VM, callback
state (Ready/Running/Waiting/Yielded/Complete/Cancelled), error isolation,
per-callback async bridges, and transactional registration rollback. The VM
core stays timer-free apart from the generic owned-value registry. Admission
limits travel with every registration and are MUST-enforce obligations on the
backend; `timer::pending_count` / `timer::running_count` are pure backend
queries and the module keeps no counters of its own.

The callback parameter is typed `fn(bool) -> unknown`: the callback observes
the `premature` flag and its return value is discarded, so the declared result
is `unknown` -- any `int`/`string`/`map`/`bool`/`null` body compiles and runs,
and the value is dropped instead of accumulating. This is the one deliberate
dynamic occurrence in the public timer surface; the typed-catalog guard records
it as its narrow discarded-callable-result policy exception.

Downstream adapter surface: `register_owned_timer` lets an embedding expose the
same contract under its own exact host name and schema -- it takes the owned
call, the callback argument index, and a checked `Duration` plus an optional
repeating `Duration`, and reuses the runtime lookup, callback type/provenance
checks, fresh isolated callback VM, admission limits, backend registration and
rollback of the standard adapters, so `OwnedTimerCallback::new` never needs to
become public. `installed_timer_counts` exposes the installed backend's
synchronous pending/running counts for thin adapter count functions. Both
helpers are name-independent and unit-independent; `timer::at` / `timer::every`
are millisecond adapters over the same path.

The builtin runtime composes the timer surface into the standard catalog, so a
compiled program resolves the imports and each call fails with the documented
installation error until backend state is installed.

The module's own tests cover the callback state machine through the private
callback VM: waiting rounds on independent per-callback bridges, cancellation
of a waiting round, panic and error isolation with recovery for `start` and
for the resumed/polled round, the discarded callback return (no result or
operand accumulates), and overlapping-round rejection.

Author: fffonion

src/builtins/runtime/mod.rs

@@ -37,13 +37,21 @@ pub(crate) mod regex;
 #[cfg(all(feature = "sqlite", not(target_arch = "wasm32")))]
 pub(crate) mod sqlite;
 pub(crate) mod standard_composition;
+mod timer;
 mod typed;
 
 pub use jit::{
     jit_host_catalog, register_jit_builtin_module, register_jit_builtin_module_from_catalog,
 };
 #[cfg(all(feature = "sqlite", not(target_arch = "wasm32")))]
 pub use sqlite::{register_sqlite_builtin_module, register_sqlite_builtin_module_from_catalog};
+pub use timer::{
+    DEFAULT_MAX_PENDING_TIMERS, DEFAULT_MAX_RUNNING_TIMERS, OwnedTimerCallback, TIMER_CALLBACK_ARG,
+    TimerBackend, TimerCallbackError, TimerCallbackState, TimerCallbackStatus, TimerConfig,
+    TimerCounts, TimerExtension, TimerHostExt, TimerHostState, TimerRegistration,
+    installed_timer_counts, register_owned_timer, register_timer_builtin_module,
+    register_timer_builtin_module_from_catalog, timer_host_catalog,
+};
 
 /// Returns the editor/compiler catalog for the built-in host extensions.
 ///
@@ -375,6 +383,21 @@ pub fn standard_host_catalog() -> Arc<HostApiCatalog> {
                 builder.function(function.clone());
             }
         }
+        {
+            // The standard timer surface: exact catalog entries whose owned
+            // callbacks are registered by `TimerExtension` /
+            // `register_timer_builtin_module`, exactly like the other exact
+            // adapter surfaces. A compiled program resolves the imports from
+            // this catalog; each call then fails at the runtime boundary until
+            // backend state is installed.
+            let timer_catalog = timer_host_catalog();
+            for schema in timer_catalog.structs() {
+                builder.named_struct(schema.clone());
+            }
+            for function in timer_catalog.functions() {
+                builder.function(function.clone());
+            }
+        }
         Arc::new(builder.build().expect("standard host catalog is valid"))
     }))
 }