Upstream ports/, exams/, and ct-runner to the polymorph repos

[lann]

The consumer-facing pieces were developed in-repo as reference implementations and are pending upstreaming to their proper homes (cross-repo, operator-driven):

• ports/websocket → polymorph-websocket (their conformance suite runs 55/55 incl. TLS under this port; README notes the one platform delta — Deno abnormal-close code 0)
• ports/webcrypto → polymorph-webcrypto (11 families today; webcrypto port: complete the remaining algorithm families #3 tracks completion)
• ports/webrtc → polymorph-webrtc-datachannels (echo-demo green over real data channels; note the npm-backend import-map requirement for foreign entry projects, and werift fallback is unverified)
• exams/iroh-endpoint → polymorph-iroh (the endpoint exam, 5/5)
• ct-runner → polymorph-test (an L3 runner for their L1 contract, emitting schema-exact L4 JSONL; upstream would add CLI/L6 integration, tag scheduling, lockfile folds, sharding)

Migration story per repo: delete the jco fork pins, transpile steps, generated trees, and flag-verification scripts; replace the Node 24+JSPI lane with a flagless Deno lane; browser legs via the deltic lanes.

Prerequisite: #16 (versioned releases) — consumer repos should pin a published deltic version, not a git checkout.

[lann]

polymorph-test migration started (Phase 1 landed as polymorph-test#75, side-by-side with the jco legs).

Mechanics proven for the interim pin scheme (#16): consumer runs deltic straight from the release tag — raw.githubusercontent import-map URLs + committed deno.lock (--frozen) for the module graph, release-asset translator wasm sha256-pinned by their fetch-translator.ts, cross-checked at run time. Equivalence gates: deltic's human output and fold output byte-match the goldens shared with their composed-cli/jco legs; ct-runner's --translator flag (#23) was the enabling change.

Remaining phases, in order:

• Phase 2 — fixture/tag-scheduling parity in our ct-runner: --missing + tags custom-section inventory (their embed leg schedules tag-gated cases to not-applicable; the deltic leg currently runs feature-blind, scheduling: "none", with lane-specific goldens). Also: emit diagnostics-complete: true on returned cases (we already emit false correctly on the trap path; upstream emits it always). Optional DX: a --wasi flag on the ct-runner CLI (baseline wasiShims()) — polymorph-test ended up with repo-owned glue so it doesn't need it, but our own ports/websocket runner hand-rolls exactly this.
• Phase 3 — browser legs + Pages viewer off jco (their runPageHarness/worker plumbing; the viewer-aggregate transpile is sync jco, needs the P1 generated-JS story or a runtime-linked page path).
• Phase 4 — cutover PR: delete jco pins, transpile scripts, flag-verification, the Node 24+JSPI lane; Node stays a distribution target only.

Findings for the migration record: at a pinned tag, wasi-shims/src/io.ts imports @deltic/runtime/embedder by bare specifier — resolved by our workspace config, so URL consumers must add one extra import-map entry (documented in their js/runner-deltic/README.md); JSR publishing (#16) obviates this.

[lann]

Phase 2 (deltic side) complete — #30 merged: ct-runner reads the suites' own component-test:tags@0.1 inventory (survives wac composition — verified on the tls artifacts), schedules per-target inapplicable cases to not-applicable in the embed runner's exact wire shape, --missing on the CLI, diagnostics-complete: true parity on returned rows. #25 closed; the tls smoke now runs zero-failure/zero-xfail on all three compositions.

polymorph-test side, deferred to the next deliberate pin bump of their verify-deltic lane: fixture leg gains hsm N/A rows + scheduling: "tags" envelopes, their runner.ts needs a not-applicable render branch, lane goldens regenerate. Remaining phases unchanged: Phase 3 (browser legs + Pages viewer — packaging story, interpreter already at browser parity; per the #8 rescope, no eval anywhere), Phase 4 (jco deletion, ideally behind #16's registry story).

[lann]

Prerequisite relaxed per #16 decision (2026-08-09): registry publishing is deferred, so upstreaming does not wait on a published package. Consumer repos pin a git reference and/or prerelease artifact (pre-<shorthash> releases) instead.