Batch PHP support and bundle ABI updates with their runtime changes

[brandonpayton]

What this PR does

This PR brings together all of the PHP work we plan to merge. It combines the
changes from #866, #871, and #894 with five related PRs that were reviewed
separately: #845, #856, #884, #905, and #906.

The main result is PHP 8.3.15 with the zip, curl, and intl extensions,
built and run through the same Kandelo systems used by other software: the SDK,
C library, package resolver, virtual filesystem, kernel, and shared
Node.js/browser runtime.

Porting PHP turned out to be a pretty good stress test for Kandelo. It exposed
bugs and missing Unix behavior in processes, files, networking, signals,
timers, and the browser runtime. This batch fixes those problems in Kandelo
itself instead of adding PHP-only workarounds.

Fresh staging and all CI test suites are green on the exact head below.
This PR is still not ready to merge: the full PHP test inventory, the manual
browser feature pass, the performance decision, and Brandon's explicit
approval are still outstanding.

What this adds

• A reproducible PHP 8.3.15 package that can be installed in Kandelo's normal
  filesystem image, tested with PHP's PHPT suite, and launched from the browser
  demo.
• zip.so, curl.so, and intl.so as regular optional packages—not local
  checkout additions or demo shortcuts.
• Platform fixes that PHP and other programs can use:
  • Processes and threads: fork, exec, wait, pthread cleanup, signals,
    and POSIX timers.
  • Files and paths: file descriptor ownership, shared mappings, file-size
    limits, path lookup, symlinks, pathconf, and filesystem metadata.
  • Networking: TCP shutdown, UDP pressure and truncation, multicast and
    broadcast, AF_UNIX sockets, nonblocking connections, and socket errors.
  • Host/runtime behavior: procfs, scheduler affinity, process environments,
    cancellation, select/pselect, and worker coordination.
  • Builds and packages: reproducible builds, root certificates, filesystem
    images, browser assets, test diagnostics, and ABI documentation.

The affected runtime code is shared by Node.js and browser hosts. Both hosts
passed the final staging suites; the hands-on browser feature checks are still
listed below.

Why the ABI updates stay bundled with their runtime changes

The PHP work is batched into one PR because its package, the host runtime, and
the kernel all have to agree on the same ABI. The ABI is simply the binary
contract those pieces use to talk to one another.

The first 42 commits are the reviewed PHP and ABI sequence. They stay in a
straight line, with no merge commits, and we plan to rebase-merge them in that
order. Whenever a runtime change breaks the binary contract, that same commit:

1. makes the runtime change;
2. increments ABI_VERSION; and
3. regenerates the ABI snapshot plus the C and TypeScript bindings.

That bundling keeps every version from 19 through 39 internally consistent. A
later ABI bump cannot repair an earlier commit whose code and generated files
disagreed.

Changes that do not break the ABI get their own commits when that makes them
easier to review or revert. Staging found three more real issues after the
42-commit sequence was locked, so those fixes remain as three focused follow-up
commits instead of rewriting already-reviewed history.

We do not rebuild PHP, packages, or filesystem images after every commit in the
batch. We rebuild them together from the final head. The one historical
exception is #740/#757: PHP needs the VM-interrupt hook from #757, so those
pieces share one commit and never leave an unusable intermediate revision.

Exact version under review

• Branch: candidate/php-abi-superbatch-curated-v2
• Head commit: 0f464442db59397fab7098ae154d7e9640cc345c
• Tree: 8bd862d26ef90d31cbfb61d0de504bdcfd7053b2
• main when this branch was published:
  2c083e143618e4974a637b649e6221c64f0dd936
• History: 45 commits, zero merge commits
• Final ABI version: 39

The planned 42-commit PHP/ABI sequence has not been added to, removed from, or
reordered. The final three commits fix concrete CI serialization, browser
filesystem-image, and dinit package failures found during staging. None changes
the ABI, so the final ABI version remains 39.

Fresh staging and every automated test suite are now green on this head. The
remaining work is the full PHP inventory, hands-on browser feature checks, the
performance decision, and final approval.

Full ABI 19–39 commit map

Each row is one commit that updates the implementation, ABI_VERSION,
abi/snapshot.json, libc/glue/abi_constants.h, and
host/src/generated/abi.ts together.

ABI	Commit	What changed
19	4dedef7f4	#749 connects TCP EPIPE errors to the correct SIGPIPE behavior
20	551fe6129	#750 correctly rejects unsupported mremap flags
21	911acf77e	#744 makes procfs show the real process state
22	9c15c9728	#754 fixes socket addresses, descriptors, routing, pointers, and errors
23	7283311de	#755 fixes orderly TCP shutdown and reader state
24	f516785eb	#859 fixes datagram pressure, readiness, wakeups, and deadlines
25	2208a2a6f	#860 adds broadcast behavior and fixes MSG_TRUNC and zero-length pointers
26	9e07b4d73	#756 fixes process, fork, exec, file descriptor, and memory ownership
27	99c0561fc	#740/#757 add the PHP package and the host VM-interrupt hook it needs
28	22e72dfd3	#757 fixes shared Node.js/browser filesystem, process, path, timer, and file descriptor behavior
29	477b9c73b	#758 fixes cancellation, seeking, and interrupted select/pselect calls
30	702f72834	#742 fixes launch environments and chown sentinel values
31	71bb2a2f7	#748 enforces file-size limits before writes begin
32	579fd76be	#741 resolves paths one component at a time
33	253ff6cf2	#743 fixes ownership changes on symlinks that must not be followed
34	b1920638e	#752 fixes pathconf marshalling for live objects
35	5dc018481	#759 fixes wait status, resource usage, and pthread lifecycle
36	7a112faf3	#839/#894 fix side-module replay and coordination between pthreads and fork
37	4ecf44abe	#856 tracks pending external TCP connections correctly
38	abc2b8ef7	#884 fixes scheduler-affinity masks and task lookup
39	bcb02e938	#906 delivers POSIX timers and adds the required timer-fire export

Each of these 21 commits passed the ABI check against the commit immediately
before it. The kernel also compiled at every ABI-changing commit from 19
through 38. ABI 39 passed the exact-commit kernel tests listed below.

The current example in docs/porting-guide.md now uses ABI 39.

What is included

The three main PHP PRs are #866, #871, and #894. Their changes are included
here in dependency order instead of merging those PR branches into one another.

The ABI-changing work is listed above. These useful changes do not need an ABI
bump, so they remain easy to review on their own:

• [PHP] fix: preserve unix socket path ownership in stat #753: uses the real AF_UNIX inode metadata;
• [PHP] test: verify AF_UNIX listener queues across fork and exec #745: tests that an inherited AF_UNIX listener survives exec;
• [PHP] fix: provide OpenSSL defaults from rootfs images #746: puts the OpenSSL configuration and public trust roots in the filesystem;
• [PHP] refactor: preserve first-fit mmap gap selection #751: uses an equivalent first-fit mmap strategy, with no performance
  claim;
• [PHP] Ship the libzip-backed ZIP extension #647: adds reproducible libzip and optional PHP zip.so;
• [PHP] Ship the libcurl-backed curl extension #648: adds reproducible libcurl/curl and optional PHP curl.so.

Running everything together also uncovered smaller bugs. This branch includes
fixes for PHPT result reporting, OpenSSL/PHP feature reporting, process cleanup,
Sortix diagnostics, dinit exceptions, shared mappings after unlink, queued TCP
data after detach, side-module buffer limits, browser shutdown and scheduling,
socket timeout layouts, memory64 fixtures, macOS program lookup, benchmark
evidence, and deferred cancellation. The commit messages keep the source and
reasoning for each fix.

Follow-up fixes found by staging

The locked batch exposed three additional problems when it ran in the final CI
and browser paths:

• Vitest 4 no longer understood our old worker-limit setting, so CI could start
  too many expensive host tests at once. The new setting restores serialized CI
  execution and the affected tests now wait for the real runtime state.
• The browser image builder copied only files directly inside /etc. It now
  merges the full directory tree, including nested certificate files, while
  preserving files supplied by the caller.
• dinit treated a normal child-process exit as a fatal exception in Wasm. The
  package now lets that signal reach dinit's existing handler without disabling
  normal C++ exception reporting.

Each fix is a separate final commit because each has a different cause and can
be reviewed or reverted on its own. None changes the ABI.

Other PRs included in this batch

PR	What we kept
#845	Included without an ABI bump as e9e3673fd. It catches fork-buffer overruns and applies the same guard to main, pthread, and side-module buffers.
#856	Included as ABI 37. It handles pending external nonblocking TCP connections, retries, readiness, and SO_ERROR.
#884	Included as ABI 38. It adds the one-CPU scheduler-affinity API with corrected pointer, length, mask, and task-lifetime behavior.
#905	Included without an ABI bump. Internal host spawn events now report the real parent. Guest getppid() was already correct.
#906	Included as ABI 39. The host schedules timer deadlines; the kernel handles expiration and sends the signal to the exact thread. It also fixes wasm64 siginfo_t layout conversion.

Those source PRs remain open as review records. Including their work here does
not merge, retarget, or separately approve them.

Reviewed work not included in this batch

• [PHP] fix: restore boxed process construction helpers #747 was closed as superseded. No code from it was replayed.
• Honor MSG_NOSIGNAL on AF_INET loopback stream send #858 was closed because [PHP] fix: raise SIGPIPE for bridged TCP EPIPE #749 contains the same fix with broader coverage.
• fork: size continuation save buffers from live frames #862 relies on stale cursor assumptions and does not fully protect the fork
  buffers.
• kernel: implement FIFO (named pipe) semantics — fixes process substitution / brew config #864 stores FIFO state beside the filesystem instead of using real VFS-owned
  inodes.
• Make desktop process state and lifecycle truthful #886 conflicts with the process, procfs, pipe, and deadline model used here.
  Any useful remaining work needs a new review.
• Fix SQLite all-mode mmap regressions #770 changes how the host interprets pointers and would need its own ABI
  version. It is not part of this PR.
• Stale Kernel UDP host-relay abstraction #530, Add VFS image for WordPress development #546, Support native Squeak browser demos #559, Move more host logic ownership into Rust #592, Adopt SQLite project unit test harness #692, Adopt MariaDB project test harness #694, and Fix mmap accounting under partial munmap churn #769 still need to be excluded
  or rebuilt before they could be considered.
• SDL2 on Kandelo - GLSL shader playground demo #709 is still tied to draft Add ALSA audio backend and espeak-ng browser demo #698 and is not part of this batch.

Checks run on the current head

“Current head” here means 0f464442d.

Check	Result
GitHub staging workflow	84 passed, 2 intentional skips, 0 failures
Staged package matrix	14 library + 57 program builds passed
Final CI suites	Kernel, fork instrumenter, Vitest, browser, libc, POSIX, and Sortix passed
Strict local browser fetch	68/68 packages resolved, with no fallback or cache mismatch
Full local host/Vitest suite	1,353 passed, 2 expected failures, 45 skipped
Focused CI, browser-image, and dinit regression tests	10/10 passed
Teardown and pthread checks under Node.js plus Bun/JavaScriptCore	3/3 passed
Host declaration typecheck and browser production build	Passed
Clean dinit revision 5 package build	Passed
Chromium OpenSSL-rootfs and WordPress/MariaDB paths	2/2 passed
Separate GitHub browser smoke workflow	Passed
git diff --check origin/main..HEAD	Passed

The complete staging run is
29224188992.
It rebuilt or resolved the exact-key artifacts, prepared one shared test
workspace, and passed every split test suite against it. The local app also
launched through ./run.sh --pr-staging --fetch-only browser and returned
HTTP 200 with the required browser isolation headers.

The ABI-39 commit itself is still bcb02e938. At that commit, the ABI
checker verified the snapshot, C output, TypeScript output, and required
timer-fire export, and the kernel/shared checks passed. The three follow-up
commits do not touch the ABI files or Rust kernel.

The only pending GitHub status is merge-gate. That is the expected manual
ready-to-ship gate, not a failed test. It should stay pending until the remaining
manual checks and approval are complete.

This evidence covers the final package matrix and automated conformance suites.
It does not yet claim the full PHP PHPT inventory, the hands-on browser feature
pass, or a performance result.

Useful earlier results from ABI 38

The previous ABI-38 checkpoint had:

Check	Result
Fork instrumenter	186/186 passed
Full host run	1,261 passed, 2 expected failures, 127 skips
libc suite	303 passed, 20 expected failures, 1 known flaky test that passed on this run
POSIX suite	174 passed, 3 expected failures, 2 skips
Sortix suite	5,033 passed, 23 expected failures, 53 skips

ABI-38 musl, programs, packages, host bundles, and root filesystem were rebuilt.
Dedicated scheduler-affinity coverage also passed in real Chromium. These runs
had no unexpected failures, build errors, or timeouts.

That is useful context, but it is not final ABI-39 evidence.

Fresh wasm32 and wasm64 musl builds, plus the normal program build, also
completed while #906 was being rebuilt. They happened before the final
shared-host siginfo_t fix, so they do not replace a clean build from the exact
commit above.

A local build.sh run was deliberately stopped during the expensive ABI-39
package and filesystem-image build. It is not counted as a passing build.

What is still needed before merge

• Lock the 42-commit PHP/ABI order and verify that every ABI 19–39
  commit keeps its code change, version bump, and generated files together.
• Run the ABI checker against the commit immediately before ABI 39.
• Run the exact-commit kernel, shared, focused host, host build, and diff
  checks.
• Materialize the exact-key wasm32/wasm64 toolchains and build the kernel,
  fork instrumenter, programs, host bundles, packages, PHP extensions,
  filesystem images, and browser assets.
• Run the complete fork-instrumenter and host test suites against that
  artifact set.
• Run the libc, POSIX, and full Sortix conformance suites.
• Run the full PHP test inventory in real Chromium from one clean,
  unchanged source and artifact set. Keep both structured results and raw
  output.
• Launch the normal browser path from the strict PR staging index and
  verify that the app is served with browser isolation enabled.
• Manually check PHP, ZIP, curl, intl, networking, processes, persistence,
  and user-visible error reporting in that browser app.
• Complete the Node.js/browser performance runs, or clearly document that
  the risk was not measured. This PR currently makes no performance claim.
• Finish staging CI on this commit and confirm that no generated source
  files changed unexpectedly.
• After the remaining checks and approval, apply the ready-to-ship label so
  the durable release workflow can turn merge-gate green.
• Get Brandon's explicit approval for the final rebase merge.

Known limits

• Loading dynamic modules from a pthread is still unsupported. Kandelo returns
  an explicit unsupported error instead of pretending it worked.
• Optional compression backends outside the reviewed zip.so path were not
  included.
• The focused curl tests did not cover HTTPS certificate flows or arbitrary
  remote endpoints.
• We are not yet claiming complete Node.js/browser parity, complete application
  behavior, or any performance result. Those claims depend on the final checks
  above.

How to merge this

• Keep the source PHP and supporting PRs open as review records. Do not merge
  them into one another or into main first.
• When everything above is complete and approved, use
  gh pr merge --rebase.
• Do not squash this PR or create a merge commit. Either option would lose the
  one-commit-per-ABI-change structure that was reviewed.
• Do not merge until every required check has finished on this exact commit and
  Brandon has explicitly approved it.