error contract: freeze the closed set; extension conditions get a gated registry

[lannbot]

Fixes #193, Fixes #194 — one decision plus its enforcement artifact: the freeze ruling defines what the registry registers, and the registry's gates are what make the ruling more than prose, so they land together.

The ruling (#193)

wit/README.md's error contract drew the closed/extension boundary by level ("the generic kinds' universal conditions" vs "algorithm- and feature-specific conditions"). The package's second named condition falsified that language: message-too-long is kind-level (public-encryption) and shipped as an extension pair. The contract now says what the package practices:

• The closed set is frozen — the conditions the contracts named when the variant was designed, a historical artifact rather than a tier of generality. It never grows: a new closed case is semver-major (return-position variant, no compatible growth path).
• Every named condition since — kind-level and algorithm-level alike — is an extension pair under "polymorph:webcrypto", defined by the interface whose contract says when it occurs.
• One absolute boundary, restated: failed verification reports authentication-failed and nothing else; no extension condition may ever carry a verification verdict.

AGENTS.md's summary of the contract is updated to match.

The registry (#194)

#194 deferred the machine-readable registry until the second condition made spelling drift a real bug class; that trigger fired. wit/extension-conditions.json now records each pair → defining interface → DOMException name → summary, and the static spelling sites are gated against it:

gate	mechanism
rust/core constants + Error constructors	unit test, exact two-way match (rides just test / just check)
rust/guest extension constants module	unit test, exact two-way match
componentize shim EXTENSION_ERRORS table	check-extension-conditions.mjs brace-matches the literal out of webcrypto.js (componentize-js resolves only WIT specifiers, so the shim stays a single module — the first CI run's resolve_import panic proved the constraint) and requires an exact mirror; wired into just componentize::typecheck

The gates found real drift immediately, which is the issue's thesis demonstrated:

• the guest SDK had no MESSAGE_TOO_LONG constant at all — a consumer wanting to branch on the package's second condition (the fall-back-to-hybrid-wrapping signal) had to spell the pair itself;
• the SDK's origin constant still carried the pre-rename LANN_WEBCRYPTO name (no in-repo consumers; renamed to extension::ORIGIN under the fix-in-place regime);
• the shim's table lacked message-too-long — behaviorally invisible, because both known pairs' DOMException mappings coincide with the unknown-pair fallback (OperationError), which is exactly why extension-condition registry: one machine-readable source for known (origin, name) pairs, gated — deferred until the second condition #194 called the table unobservable-in-principle and why the gate is static rather than behavioral.

Deliberately not gated

The construction sites in the hosts (rust/core transport, js/jco, js/deltic) and the conformance/demo literals stay as they are: those spellings are pinned behaviorally by the conformance suites on every target (sha1_checked_postures, the rsa_oaep message-too-long probes) and by the componentize-demo transport check. The registry gates cover exactly the surfaces the suites cannot see.

Verification

• just check (fmt, clippy, validate-wit — a .json in wit/ is inert to WIT resolution — and the Rust tests, including both new gates)
• just componentize::typecheck (tsc + the new registry check)
• Negative-tested both gate directions: a mutated registry name fails the Rust tests and the shim check with pair-naming diagnostics before revert
• just componentize::test (composed demo, 19 checks including the extension-error transport pin) and just wpt::test (census green) pass locally against the pinned toolchain