[octalide]

Closes #184

The serve half of #184, on top of the provider interfaces from #185. Part of #183.

Plan

• laurel.serve: serve.Host is created first and owns the built-in providers, which serve.providers(host) hands the application as one provider.Provider entry. serve.run(host, app, config) serves an assembled application on http.server.server until a drain finishes, then serve.destroy(host).
• Request bridge. Each exchange's scratch holds laurel's request state and the request arena. serve routes, binds (app.bind_context), executes, and resumes a suspended step when the server re-enters it. A step's handler deadline is handed to the server as Call.wake_at, and a step past it is timed out through the exchange scope. abandon runs the owed middleware exit halves, and the server's settle releases the context (app.release_context) once the response is written, so the terminal event carries the final transfer and a drain waits for responses still on the wire. A request the application cannot admit is answered 503.
• Lifecycle through the server's hooks: start is app.start, ready is app.poll_ready then Config.ready, drain(deadline) is app.drain plus task.drain on the application's task provider with the same deadline, and stop is app.stop then task.stop. A start the server abandons never reaches its stop hook, so run stops the application and tasks itself within stop_timeout_ns.
• Signals. With Config.signals, run owns the process's std.process.events source for its duration, and SIGTERM or SIGINT (console close or service stop on windows) calls hs.shutdown, the bounded drain to drain_timeout_ns.
• Built-in providers, each replaceable by listing the application's own provider for the key first:
  • task runner: laurel.testing.tasks becomes laurel.task.runner, one runner for both hosts. It is now thread-safe: every call and poll take its lock, and a step runs with it released. laurel.testing steps it by hand, and laurel.serve drives it from its own thread, woken by on_wake and next_due.
  • configuration and secrets from the environment under configurable prefixes. A secret is copied into welded stack scratch for the borrow and wiped after it. The resolver sits in a bounded module-private table, since it cannot erase.
  • telemetry: one line per signal on stderr, written with one call.
• Example: demo/standalone is one application, hosted by laurel.serve in bin/main.mach and tested in process under laurel.testing with the same assemble. CI builds it and runs its test on the primary leg.
• Docs: doc/serve.md (the contract and the current limits), doc/providers.md (runner and built-ins), and the README's two hosting modes.
• Re-pin: http ^0.23 at v0.23.0 via mach dep update.

Needed from mach-http, released as 0.22.0 and 0.23.0

• server: a runner that serves a handler over HTTP/1.1 (listen, accept, drain) mach-http#189 (0.22.0): the server runner.
• server: tell the handler when its exchange settles, and wake a pending handler at its deadline mach-http#198 (0.23.0): Handler.settle, since nothing told a handler when its exchange was terminal, and Call.wake_at, so a handler deadline needs no timer thread.
• server: a response without framing fields is close-delimited, so keep-alive ends after it mach-http#200 (0.23.0): the runner frames a response the handler left unframed. Every laurel response was close-delimited before it.
• test/load: the heap is compared at a point the server has not settled mach-http#196 (in 0.22.0): the load cell's heap check raced the server and failed the release run on x86_64-darwin.

Current limits, stated in doc/serve.md and the README

• No WebSockets in standalone mode until the runner supports upgrades (server: support protocol upgrades (WebSocket) and CONNECT in the runner mach-http#191).
• A long streamed response is cut off at the runner's whole-exchange request deadline unless it is raised (server: a streamed response is bounded by the whole-exchange request deadline mach-http#193).

Not in this PR

The hedge-hosted demo, and the bench server hosted the same way, stay here until graft takes them (briar-systems/graft#1). hedge 0.12.0 pins http =0.21.0, so both override it by ref = "tag/v0.23.0". 0.22 and 0.23 only add the runner and fix the h1 engine compatibly, and the demo builds that way.

Local runs

mach 6.3.0: mach test . for the library, mach test demo/standalone, and mach build demo. I ran the example binary with curl (keep-alive, framing, config, task snapshot, echo) and sent it SIGTERM. The SIGTERM test also ran against a counterfactual with the signal thread's shutdown removed, and it fails.