third_party: import the 0magnet modules instead of copying them

[0pcom]

The copies under third_party/0magnet/ were staging — sources vendored by hand so the browser-terminal work could move without a round trip through another repository. That trade has stopped paying, so this removes them and requires the modules by their own paths.

Why now

The copies had already drifted. xterm-go and websh gained a ResizeObserver so the terminal re-fits to its container rather than to the window — which is precisely what the hypervisor UI needs, since the terminal there lives inside a WinBox window and the window resize event is not the same thing. None of that was in the copy. Pinning the modules picks it up.

What changed

• third_party/0magnet/ deleted
• five direct requires added; u-root resolves indirectly through websh, which already requires afero, sh/v3, u-root and xterm-go itself — so those versions come from one place rather than being pinned twice
• no replace directives — each fork is a module in its own right and resolves normally
• four files outside the copied trees imported them, none reaching into an internal/ package, so the rewrite is a straight path substitution

Most of the diff is git recognising the sources as renames from third_party/ into vendor/.

The pins also carry an afero fix: its TinyGo shims were gated on the whole tinygo build tag, which handed ENOSYS stubs to TinyGo's linux and wasip1 targets for os.Chmod, os.Chown and os.Link — functions those targets implement. They are now narrowed to tinygo && js, which is the only target actually missing them. Same change proposed upstream as spf13/afero#650.

The dependency question, stated plainly

This puts five direct requires on github.com/0magnet/* into go.mod. That is a real change in kind from vendored copies, and reviewers should weigh it rather than discover it: upstream's build would depend on repos outside the skycoin org.

Two things bearing on it. There is precedent — github.com/0magnet/coloredcobra is already an indirect dependency here. And the intent is to move these forks into the skycoin org, after which the paths change again. If maintainers would rather wait for that move, this can sit until then; the alternative is carrying stale hand-copied sources in the meantime, which is what prompted this.

Verification

Passing:

• go build . — native
• GOOS=js GOARCH=wasm go build ./cmd/websh-probe ./cmd/wasm-visor
• tinygo build -target wasm ./cmd/websh-probe — the lane that exercises the narrowed afero and sh build tags
• go mod tidy and go mod vendor clean

Not yet run: pkg/tpviz/wasmgl, the only consumer of cosmos-go. Worth noting it appears in no Makefile compile-check lane — neither build-wasm nor build-wasm-tinygo — so it has no gate today. The remaining wasm artifacts are being rebuilt separately before this merges.