feat(timer): add the standard timer host module

Add the self-contained timer host-function module with
`timer::{at,every,pending_count,running_count}`, the `TimerBackend` contract,
`TimerConfig`/`TimerRegistration` admission limits, and the `TimerExtension`
composition/install entry point.

The module owns callback ownership transfer, the private callback VM, callback
state (Ready/Running/Waiting/Yielded/Complete/Cancelled), error isolation,
per-callback async bridges, and transactional registration rollback. The VM
core stays timer-free apart from the generic owned-value registry. Admission
limits travel with every registration and are MUST-enforce obligations on the
backend; `timer::pending_count` / `timer::running_count` are pure backend
queries and the module keeps no counters of its own.

The callback parameter is typed `fn(bool) -> null`: the callback observes the
`premature` flag and its return value is discarded, so the declared result is
the typed expression of "no result" -- this revision's public host catalogs
carry concrete schemas only.

Downstream adapter surface: `register_owned_timer` lets an embedding expose the
same contract under its own exact host name and schema -- it takes the owned
call, the callback argument index, and a checked `Duration` plus an optional
repeating `Duration`, and reuses the runtime lookup, callback type/provenance
checks, fresh isolated callback VM, admission limits, backend registration and
rollback of the standard adapters, so `OwnedTimerCallback::new` never needs to
become public. `installed_timer_counts` exposes the installed backend's
synchronous pending/running counts for thin adapter count functions. Both
helpers are name-independent and unit-independent; `timer::at` / `timer::every`
are millisecond adapters over the same path.

The builtin runtime composes the timer surface into the standard catalog, so a
compiled program resolves the imports and each call fails with the documented
installation error until backend state is installed.

Author: fffonion

src/builtins/runtime/mod.rs

@@ -37,13 +37,21 @@ pub(crate) mod regex;
 #[cfg(all(feature = "sqlite", not(target_arch = "wasm32")))]
 pub(crate) mod sqlite;
 pub(crate) mod standard_composition;
+mod timer;
 mod typed;
 
 pub use jit::{
     jit_host_catalog, register_jit_builtin_module, register_jit_builtin_module_from_catalog,
 };
 #[cfg(all(feature = "sqlite", not(target_arch = "wasm32")))]
 pub use sqlite::{register_sqlite_builtin_module, register_sqlite_builtin_module_from_catalog};
+pub use timer::{
+    DEFAULT_MAX_PENDING_TIMERS, DEFAULT_MAX_RUNNING_TIMERS, OwnedTimerCallback, TIMER_CALLBACK_ARG,
+    TimerBackend, TimerCallbackError, TimerCallbackState, TimerCallbackStatus, TimerConfig,
+    TimerCounts, TimerExtension, TimerHostExt, TimerHostState, TimerRegistration,
+    installed_timer_counts, register_owned_timer, register_timer_builtin_module,
+    register_timer_builtin_module_from_catalog, timer_host_catalog,
+};
 
 /// Returns the editor/compiler catalog for the built-in host extensions.
 ///
@@ -375,6 +383,21 @@ pub fn standard_host_catalog() -> Arc<HostApiCatalog> {
                 builder.function(function.clone());
             }
         }
+        {
+            // The standard timer surface: exact catalog entries whose owned
+            // callbacks are registered by `TimerExtension` /
+            // `register_timer_builtin_module`, exactly like the other exact
+            // adapter surfaces. A compiled program resolves the imports from
+            // this catalog; each call then fails at the runtime boundary until
+            // backend state is installed.
+            let timer_catalog = timer_host_catalog();
+            for schema in timer_catalog.structs() {
+                builder.named_struct(schema.clone());
+            }
+            for function in timer_catalog.functions() {
+                builder.function(function.clone());
+            }
+        }
         Arc::new(builder.build().expect("standard host catalog is valid"))
     }))
 }