feat(3ds): run guest updates alongside offload

[doodlewind]

Pocket Map's offload build compiled out the 3DS development server and SD guest recovery. Restoring the old loop directly would put package reads, hashing, writes and fsync on the UI thread. This change runs development IO on a native worker and enables guest updates, the L+R+SELECT menu and screenshots alongside offload and SD resource packs.

Stacked on #381 (feat/local-resource-packs); the offload/image and local-pack work remains in its existing PRs.

• Move the existing authenticated wire implementation into worker-owned dev_transport.c, keeping the desktop protocol compatible. devserver.c exposes bounded release/acquire mailboxes: four input/output records, one snapshot, one candidate transaction and one borrowed screenshot pair. Sockets, pairing reads, package admission and durable commits stay off the UI thread.
• Boot embedded recovery immediately while the worker prepares a stored guest. At a GPU-idle boundary, reset the old offload/SD request generations, JS context, UI tree and GPU resources. Keep the previously accepted package resident until the new guest's first GPU submission retires and the worker commits its generation. Restore it after eval, frame or commit failure; later accepted-guest failures load last-good asynchronously.
• Require the same embedded application id, output, host ABI and exact native plan; allow JS/PAK changes. Bound SD update packages to 8 MiB and compare duplicate blobs in 4 KiB chunks instead of allocating a second complete package. The UI still performs guest teardown/eval/render: this is a guest restart, and component state is not preserved.
• Fence debug records across every guest boot, including failed eval. Retain terminal install receipts while the network output buffer is busy. Borrow screenshot buffers until transmission/disconnect ends, and keep the 48 KiB screenshot scratch buffer outside the worker's 32 KiB stack. Build-time stack-frame checks catch oversized worker locals.
• Preserve the console's existing development key when pairing from another checkout; only explicit --rotate replaces it. Capture builds keep the worker disabled. Legacy svc support remains separate.

Validation:

• 38 3DS profile/runtime/SOC/worker/pairing tests and 70 offload/resource tests pass; TypeScript passes. Seven Rust package tests cover admission and native-plan/app compatibility.
• ASan/UBSan tests run actual storage and worker code with 200 ms admission/fsync stalls, rejected eval, failed commit, recovery through last-good to embedded, stale controls, bounded output, screenshot disconnects and ownership. Actual transport tests cover oversized/rejected transfers, retained receipts and full binary screenshots.
• Production Pocket Map (offload + SD), ordinary 3DS demo and capture builds pass.
• Native Azahar E2E against Pocket Map passes: the existing UI advanced 49 frames during the delayed upload; compatible guest accepted; altered native plan, corrupt hash, throwing eval and first-frame exception rejected; a later accepted-guest failure recovered to last-good; production package restored and both screens captured.
• The console received a new native runtime with complete FTP readback. Physical in-process validation is pending exiting ftpd and opening Pocket Map; emulator results are not presented as hardware interaction acceptance.

Reproduce the live-runtime checks with tests/e2e/3ds-hot-update.ts --host … --key … --package … --out …. Pocket Map adopts this runtime and documents its guest-only update command in pocket-stack/pocket-map#3.