Own native WebSocket buffering and interruption cleanup

[relh]

Native players currently lose partial WebSocket frames after timeouts and raise on signal-interrupted polling. This blocks owned shutdown and private evidence delivery.

Add a native client using existing libcurl CONNECT_ONLY=1 for verified ws/wss connections. Buffer headers, bodies, fragments, and pending writes across deadlines. Serialize libcurl operations and complete frame writes. Keep inference interruption separate from finite cleanup delivery. Callers join their workers before closing the handle.

Validation:

• 21 real socket cases pass with libcurl8.5 and actual7.88.1 inside the retained official Knights Bookworm image. Includes32768 token IDs, fragmentation/control frames, invalid frames, TLS rejection/trust,100 concurrent exchanges,8MiB partial writes, deadlines, TERM and INT.
• Real Lantern game plus six new-client players passes10 whole fixture games:300 authoritative macros/305 fixture HTTP joins, private prompts/bytes/IDs, invalid responses/schema/token types, and32768-token metadata retained through Mummy.
• Five actual game/player interruption cases seal privateTruncated without public results. Every surviving player exits0. Partial bytes and genuine reader joins survive.
• Remote commands: nim c --parallelBuild:1 --threads:on --mm:orc -o:probe tests/support/native_websocket_probe.nim; python3 tests/test_native_websocket.py ./probe. Repeat via owned bounded Docker wrapper using coworld-knights-archers:coworld-41c9a0118422 with libcurl7.88.1.
• Proofs: Zephyrus /tmp/coworld-native-websocket-proof-v1/{test-v15.log,test-bookworm-v15.log} and /tmp/coworld-lantern-lifecycle/{native-v9,signal-v9}. All failures retained separately.

These are CPU transport and game fixture proofs. They grant no platform receipt authority or production release readiness. Game callsites will adopt the reviewed immutable dependency pin.