feat(offload): isolate provider IO behind bounded frame queues

[doodlewind]

A paired desktop can perform file, SQLite, HTTP and layout work without putting socket or filesystem operations on the PocketJS UI thread. The native worker owns transport and fixed queues; the guest delivers at most one result and one bounded coverage upload per frame. Reconnects fence stale replies, and transport never automatically replays sent mutations. Named grants constrain provider operations. This implementation is independent of #360.

Deferred content uses renderer-neutral resource states and completion tickets, plus Solid ResourceBoundary / ResourceImage components. Applications supply fallback/error subtrees while content keeps its reserved geometry. Texture handles remain cache-owned. Native coverage decoding optionally applies a bounded column palette, allowing Mac-highlighted code without handheld tokenization or pixel expansion.

Shared UI APIs include caret blinking with one cancellable virtual-clock deadline and classic controls with pressed/selected/disabled palettes, rounded panel rims and release-inside activation. ClassicSheet uses native slide/fade transitions, retains modality until closing completes, and gives its buttons a 4px gap and 4px bottom clearance.

An optional sixth frame argument carries the right analog stick. The 3DS adapter reads the New 3DS C-stick; Solid, Vue Vapor and Octane expose the same normalized/deadzoned readers. Missing hardware or old tapes read centered. DevTools lazily allocates a bounded recording lane and owns it during replay. Capture, offload and development host modes each initialize it explicitly.

Pocket Doc exercises these APIs in a separate repository against 1,000 generated Markdown files. Its provider owns full unsaved drafts; the device retains a movable bounded window. The app implements idempotent staging retries above the transport contract.

Validation: 124 targeted renderer, DevTools, 3DS-profile and platform-runtime tests; TypeScript and generated contract checks; successful production ARM build and two-screen native capture. Pocket Doc passes 28 app tests, 3,231 compiled-guest replay frames with 93 interaction checks, and 839 QuickJS frames at a 128 KiB stack. The installed device build used a 192 KiB QuickJS stack; current main independently raises the host default to 384 KiB. Earlier native sanitizer checks covered concurrent queue records and coverage/palette bounds. Current PR checks pass.

The latest production app and app-scoped pairing key are installed with byte-exact FTP readback, and its matching Mac daemon is running; the provider has received fresh device frame telemetry. A subsequent real-device demo records browsing, editing, creating a document, and opening the resulting file in Finder. Sustained frame-time acceptance remains pending. Previous builds were installed with byte-exact readback and the user accepted their UX improvements. Bounded IO does not guarantee a frame deadline for arbitrary JS or GPU work. The paired transport assumes a trusted LAN and is unencrypted. Resource UI components currently support Solid; resource state and right-stick contracts are shared across renderers.