Kernel UDP host-relay abstraction

[mho22]

First of three split PRs from #60 (emdash/explore-doom-webrtc-8179f). Adds the kernel surface and host wiring that lets the kernel route non-loopback UDP datagrams through a host-owned transport, then exposes the symmetric inbound path so the host can post datagrams back to a bound SOCK_DGRAM. No WebRTC code here — that lands in the follow-up PR.

What changes

Kernel (crates/kernel/, abi/snapshot.json)

• HostIO::send_dgram trait method on process.rs with a default -ENETUNREACH impl. Overridden only by WasmHostIO. Every existing concrete impl (MockHostIO, etc.) compiles unchanged.
• sys_sendto now dispatches non-loopback destinations through host.send_dgram instead of returning ENETUNREACH. Loopback FIFO branch is untouched.
• wasm_api.rs gains a host_send_dgram import (value-returning errno convention) and a new kernel_inject_datagram export. The export scans proc.sockets for a DGRAM in Bound/Connected state with a matching bind_port and pushes onto dgram_queue; returns -ESRCH / -ECONNREFUSED on failure.
• DoS cap: kernel_inject_datagram is bounded at MAX_INJECT_DGRAM_QUEUE_LEN = 256 per matching socket. Sized to absorb a few seconds of net-tick bursts while still bounding kernel-heap growth under a misbehaving remote feeding the queue at line rate.
• The per-process logic is extracted into syscalls::inject_datagram_into so it's unit-testable from a Process fixture; the wasm export wrapper is the only piece that still touches PROCESS_TABLE.

Host (host/src/)

• host/src/browser-kernel-protocol.ts — InjectDatagramMessage (main → kernel-worker) and HostSendDgramMessage (kernel-worker → main).
• host/src/browser-kernel-host.ts — BrowserKernel.injectDatagram() and onHostSendDgram(handler) accessors. Both are fire-and-forget; UDP drops are indistinguishable from wire loss.
• host/src/kernel.ts — KernelCallbacks gains optional onHostSendDgram; the wasm imports table binds the kernel's host_send_dgram import to a private hostSendDgram() that forwards to the callback (returns -ENETUNREACH when unset).
• host/src/kernel-worker.ts — CentralizedKernelWorker registers an onHostSendDgram default that returns -ENETUNREACH, matching the kernel-side trait default.
• host/src/browser-kernel-worker-entry.ts — adds the RelayHostShim class (postMessages host_send_dgram up to the main thread) and handleInjectDatagram for the inject_datagram message dispatch.

Dual-host parity (CLAUDE.md §"Two hosts")

• Node: no host_send_dgram registration needed — the kernel-worker default returns -ENETUNREACH (matches the kernel-side trait default). node-kernel-worker-entry.ts has no inject_datagram handler (Node has no RTCDataChannel).
• Browser: full wiring via RelayHostShim + handleInjectDatagram. The page-side RelayChannel that consumes these hooks lands in the follow-up PR.

ABI

• abi/snapshot.json regenerated. The single new kernel_exports entry (kernel_inject_datagram) is additive under the post-Allow additive ABI snapshot changes without version bumps #490 policy — ABI_VERSION stays at 11.
• kernel_inject_datagram export signature unchanged by the DoS cap commit.

Tests added

• test_udp_non_loopback_routes_to_host (kernel) — covers the new sys_sendto branch via a MockHostIO that captures (src_port, dst_ip, dst_port, data).
• test_inject_datagram_no_bound_socket → -ECONNREFUSED.
• test_inject_datagram_pushes_and_recvfrom_delivers — successful push, sys_recvfrom returns the data, src_addr/src_port restored.
• test_inject_datagram_caps_queue_and_silently_drops_overflow — 256 pushes succeed, overflow attempts return 0, queue stays at exactly 256.
• host/test/sendto-non-loopback.test.ts — boots NodeKernelHost + a tiny C program that bind() + sendto(10.0.0.1:1234) and asserts errno == ENETUNREACH. Closes the Node-host parity gap (the kernel-side test uses MockHostIO and never exercises kernel-worker.ts's actual default).

Stacked-PR series

This PR is the first of three split from the original branch. The follow-ups depend on this one being merged first:

1. [this PR] Kernel UDP host-relay abstraction — kernel + host plumbing.
2. WebRTC DataChannel relay for browser demos (split/webrtc-data-channel-relay) — standalone WebRTC chat demo + page-side RelayChannel that bridges RTCDataChannel to the abstraction landed here.
3. Multiplayer DOOM over WebRTC (split/doom-multiplayer-over-webrtc) — chocolate-doom net stack + POSIX i_net + doom-mp demo page.

🤖 Generated with Claude Code

[github-actions]

Phase B-1 matrix build status — pr-530-staging

ABI v12. 44 built, 0 failed, 44 total.

Package	Arch	Status	Sha
bash	wasm32	built	d3f62e36
bc	wasm32	built	3f9d8b42
bzip2	wasm32	built	00594792
coreutils	wasm32	built	2c7d33d1
curl	wasm32	built	4146a843
dash	wasm32	built	21fd2b13
dinit	wasm32	built	fef7e94b
file	wasm32	built	4d577cd7
git	wasm32	built	adac2e4d
grep	wasm32	built	3ee0e9c4
gzip	wasm32	built	c6ac4ceb
kandelo-sdk	wasm32	built	7d2fa7e1
lamp	wasm32	built	192bc0bd
less	wasm32	built	431586da
lsof	wasm32	built	2c7ed293
m4	wasm32	built	6dcaf0a4
make	wasm32	built	b066d56d
mariadb-test	wasm32	built	07f15fd5
mariadb-vfs	wasm32	built	9b1847a5
mariadb-vfs	wasm64	built	d58f3d27
msmtpd	wasm32	built	541a8631
nano	wasm32	built	2b4c6f4c
nethack-browser-bundle	wasm32	built	813f4cad
nethack	wasm32	built	f42afa6b
nginx	wasm32	built	1aaf2c60
node-vfs	wasm32	built	9b3f10d0
node	wasm32	built	d61cb6e7
php	wasm32	built	894abbfb
posix-utils-lite	wasm32	built	7fea317d
rootfs	wasm32	built	cbbee4f3
sed	wasm32	built	06df07c9
shell	wasm32	built	48783990
spidermonkey-node	wasm32	built	4dc4e333
spidermonkey	wasm32	built	98906836
tar	wasm32	built	fa00ec94
tcl	wasm32	built	d418f58d
unzip	wasm32	built	ae858c13
vim-browser-bundle	wasm32	built	928b3750
vim	wasm32	built	097341d8
wget	wasm32	built	b8a0829b
wordpress	wasm32	built	63105217
xz	wasm32	built	4e40c108
zip	wasm32	built	d4ca2188
zstd	wasm32	built	ecf8718d

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}