jspi/task hardening: cancellable-resume guard; async-lower onResolve attribution asymmetry (comment + tests)

[lann]

Severity: low.

1. SuspensionPoint.resume (jspi/bridge.ts:461-467) accepts
   resume(cancelled=true) without checking this.cancellable; the
   reference asserts it (definitions.py:367) and the generator twin has
   the guard (task/thread.ts:187-190). All current callers filter first —
   add the one-line assert for parity/defense.

2. Async-lower onResolve runs result lowering (potential realloc
   reentry into the guest) in a bare promise continuation
   (exec/boundary.ts:1645-1658), while the sync arm defers all CABI work
   to produce citing attribution issue Guest callback invoked with null context slot (wit-bindgen async_support.rs:578) — polymorph-tls webcrypto-composed target #24 (:1595-1601). Either the
   asymmetry is justified (no suspended frame exists in the async case) —
   then say so in a comment at the site (orchestrator owns boundary.ts) —
   or it is the same class. Also: an onResolve throw there lands in
   store.hostFailure rather than trapping through the subtask
   machinery; add a test pinning how that failure is consumed
   (string-result lowering that traps, e.g. via an OOM realloc).

Found in the 2026-08-10 adversarial conformance review (runtime + translator vs component-model @ 73b7ad5 definitions.py; wasmtime-environ 47.0.3 treated as trusted).

[lann]

Fixed by PR #103 (merged; commits 058894f/9a6bb9c/3500ab4/68dc4cf/26d6016/c855b33 per issue group — GitHub didn't link the full comma-separated Fixes list).