endpoint: event-driven wakeups replace the bounded-polling pump

[lann]

With host-jco retired (#40), the guest's portable workaround for its scheduler defect — bounded clock polling (5 ms method quantum / 10 ms pump tick) — protected nothing and cost roughly 5× handshake latency on every host (#10's header, re-measured below).

What changed

Wake-ups are event-driven in both directions, riding wit-bindgen's inter-task-wakeup channel — a guest-internal unit stream whose write resumes a task parked in waitable-set.wait; both remaining hosts deliver it (the websocket sibling's guest-provider already uses the feature):

• Methods → pump: every mutation needing a flush kicks the pump (State::kick_pump, a pure-Rust select arm): the dial's first flight, stream writes (complete or partial), FIN/RESET_STREAM/STOP_SENDING, datagrams, queued signals, connection and endpoint closes, new relays/channels, and — new — flow-control credit from consumed reads, which previously waited out the tick and could stall the sender.
• Pump → methods: wait_until parks a waker in State::waiters instead of sleeping a quantum; the pump wakes the waiters after every drain that progressed, on signal-inbox pushes, and unconditionally on its tick.
• The 10 ms tick stays: noq's timers need servicing, and the tick turn's unconditional wake bounds deadline observation (relay-open timeout, signaling deadline) and any missed wake edge at one tick.
• The never-cancel-an-import teardown discipline is unchanged; every break path sets terminal state before the pump's final wake, so no waiter can park past the pump's death.

Co-dependence: websocket pin bump

Going event-driven exposed a latent Nagle stall in the websocket sibling's wasmtime host: back-to-back small sends (STREAM then FIN, no longer batched into one tick flush) sat out the peer's delayed ACK — relay-wire echo roundtrips of 27–50 ms. Fixed upstream in polymorph-components/polymorph-websocket#45 (TCP_NODELAY, matching browser behavior); WEBSOCKET_PIN bumps to that merge commit. The two changes cannot land separately without leaving main worse: the pump change alone regresses relay roundtrips 23 → ~47 ms, and the pin bump alone asserts nothing.

Measured (this machine, medians; target/bench/report.tsv)

row	metric	before	after
endpoint-relay	handshake / roundtrip	16 / 23 ms	4 / 0 ms
endpoint-udp	handshake / roundtrip	21 / 17 ms	1 / 0 ms
endpoint-webrtc	handshake / roundtrip	14 / 23 ms	1 / 0 ms
spike-relay (baseline)	handshake	4 ms	2–4 ms
bulk relay / udp / webrtc	throughput	7.7 / 49.1 / 38.1 MB/s	27.8 / 85.1 / 49.1 MB/s

The bulk gains come from prompt flow-control credit plus the nodelay fix. The deltic exam's relay roundtrip also moved (382 → 59 ms), untracked by any budget.

Budgets

Absolute ceilings tighten 2000 → 250 ms (still order-of-magnitude guards, CI-safe). The issue asked for the win to be asserted rather than prose: an absolute ceiling can't do that without flaking (old world was ~16–21 ms), so the bench now asserts the spike-to-endpoint handshake delta (handshake_tax_ms ≤ 10 ms) — same wire, relay, and run, so runner noise cancels; the old world's +12–17 ms tax fails it, and a reintroduced quantum-stacking or Nagle-class stall on the handshake path fails it too.

Verified

just check, just probes (5/5), just matrix (12 pairings), just exam-deltic (5/5, including the #10 concurrency rows: accept parked across a handshake and woken), just bench (all budgets hold, handshake_tax_ms 0).

Fixes #42