ports/webcrypto: complete the polymorph:webcrypto@0.1.0 surface (#3)

[lann]

19 interfaces ported from the consumer's own jco host module
(js/jco/webcrypto.js, cited by file:line throughout): cipher +
aes-cbc/aes-ctr, key-wrap + aes-kw, pbkdf2 (+sha1/sha2), ecdh,
ecdsa-verify/-sign, rsassa-pkcs1-v15-verify/-sign,
rsa-pss-verify/-sign, public-encryption + rsa-oaep-encrypt/-decrypt,
and sha1-checked (fail-closed: no platform WebCrypto carries sha1dc).
Existing families upgraded where the real suites proved them
non-conformant: signature.ts rebuilt around mint-bound algorithm
records shared by Ed25519/ECDSA/RSA (the strict-point and
S-canonicality predicates kept), keyAgreement.ts generalized
(algorithm-agnostic agree with the contributory-behavior probe),
mac/aead JWK paths moved onto the shared jwkMaterial admission, and a
new host-side EC admission layer (curve-equation + JWK crv/alg
checks): Deno admits off-curve public keys and ignores JWK crv, so
Wycheproof InvalidCurveAttack vectors now refuse with
error.invalid-key as the WIT requires.

Two interpretation calls, marked // CONTRACT: in the files:

• errors.ts platformCall maps platform-originated TypeError ->
  error.unsupported and Error -> error.other instead of trapping: Deno
  reports capability limits as plain TypeErrors, and the guest must
  receive a refusal it can handle, not a trap.
• The RSA private-key posture (rsa-pss-sign, rsassa-pkcs1-v15-sign,
  rsa-oaep-decrypt) defaults to serve — Deno is a server runtime, the
  reference's Node posture; setRsaPrivateKeyPolicy("decline") gives
  the browser posture.

Against the consumer's REAL suites (conformance/run.ts, targets
deltic + deltic-signing): shared 18757 pass / 332 fail / 1 n/a,
signing 686 / 84 / 2. Every residual failure is an adversarially
verified Deno platform gap (pure crypto.subtle probes, no port code
in the loop):

1. rsassa 8192-bit IMPORTED keys: verify throws "SPKI cryptographic
   key data malformed" (ring; Deno-minted 8192 keys verify fine) —
   299 cases
2. rsa-oaep at odd modulus sizes (3104-bit etc.) with label:
   OperationError on valid vectors — 84 cases (signing suite)
3. aes-gcm: IV window limited to 12/16 bytes, decrypt refuses
   non-128-bit tags — 32 cases
4. aes-ctr: counter width limited to 32/64/128 bits — 1 case
   None is a port defect; the consumer-side migration declares them as
   gated capability features (their features mechanism, the sha1-checked
   precedent), NOT expected-fail entries. Runner output under
   conformance/ is gitignored.

Tests: families_test.ts (17 KATs, vectors named by file+tcId,
positive + negative per family), import_surface_test.ts (both suites
resolve with ZERO unresolved leaves). Gates: deno task check; port
tests 50/50 under seeds unset/1/4242; consumer tree verified clean
before/after. iroh exam not run on this host (no iroh-relay on PATH);
the exec-model integration test runs against the real iroh guest and
passes.

Closes #3.