feat(profiles): seal builtin import provenance and expose read-only editor imports

Retain the evaluated JSON launch entrypoint, seal observed builtin source bytes and digests as verified provenance, and fail on missing/corrupt dependencies without Runtime builtin reevaluation. Cover real HTTP commits and launch resolution, including worker mode and Workspace Config feature composition.

Expose read-only builtin import completions/diagnostics in the editor and rebuild wasm32 release assets with wasm-bindgen 0.2.117. Document public paths, ordinary composition, limits, resave semantics, and the lazy-cycle incident.

Validation: worker-runtime 344 library + 34 integration tests; workspace-server 609 library + 11 binary tests plus final builtin HTTP/launch tests (2); archive tests (16); native WASM tests (2); real-WASM/web tests (37), editor component tests (10); root cargo check, cargo fmt --all -- --check and git diff --check HEAD pass.

web/workspace/test/config-source/api.test.ts

@@ -226,6 +226,62 @@ Deno.test("config source API rejects unsafe revisions and oversized entry conten
   );
 });
 
+Deno.test("config source API does not materialize imported builtins in the workspace file list", async () => {
+  const body = {
+    ...tree,
+    snapshot: {
+      ...snapshot,
+      entries: {
+        "profiles/main.dcdl": {
+          ...entry,
+          content: 'import "$builtin/profiles/companion.dcdl"',
+        },
+      },
+    },
+  };
+  const fetcher = (() => Promise.resolve(response(body))) as typeof fetch;
+  const result = await fetchConfigTree("w", fetcher);
+  assertEquals(Object.keys(result.snapshot.entries), ["profiles/main.dcdl"]);
+  assertEquals(
+    result.snapshot.entries["profiles/main.dcdl"].content,
+    body.snapshot.entries["profiles/main.dcdl"].content,
+  );
+});
+
+Deno.test("config source API preserves unknown read-only builtin diagnostics without fallback requests", async () => {
+  const diagnostic = {
+    path: "main.dcdl",
+    revision: 7,
+    tree_digest: "sha256:tree",
+    kind: "import",
+    span: { start_byte: 8, end_byte: 40 },
+    message:
+      "unknown or non-public read-only builtin source: $builtin/profiles/missing.dcdl",
+    labels: [],
+    notes: [],
+  };
+  const calls: string[] = [];
+  const fetcher = ((input: string | URL | Request) => {
+    calls.push(String(input));
+    return Promise.resolve(
+      response({ error: JSON.stringify([diagnostic]) }, 400),
+    );
+  }) as typeof fetch;
+  const error = await assertRejects(
+    () =>
+      commitConfigTree("w", {
+        base_revision: 7,
+        base_digest: "sha256:tree",
+        changes: [],
+        entrypoints: ["main.dcdl"],
+      }, fetcher),
+    ConfigSourceApiError,
+    diagnostic.message,
+  );
+  assert(String(error).includes("main.dcdl"));
+  assertEquals(calls, ["/api/w/w/config/source-tree/commit"]);
+});
+
 Deno.test("config source API surfaces bounded failed evaluation details", async () => {
   const fetcher = (() =>
     Promise.resolve(