fix(webtty): discover transports and harden asynchronous and Windows lifecycles

[uartnet]

WebTTY advertises and selects supported transports, preserves prepared workspace and restricted engine-only access, and explicitly rejects unsupported WebTransport. Harden asynchronous ownership, cancellation, client input and response draining. Windows ConPTY receives console handles correctly when the server has redirected standard streams.

Windows pipe shutdown now joins the dedicated workers before closing their handles, retrying cancellation when it precedes the actual synchronous system call. This fixes a naturally reproduced ConPTY shutdown deadlock on Windows Server2022. The common console adapter uses the same shutdown primitive and owns operation control-block storage independently of an erased handler, fixing a native ASan-confirmed use-after-free after late cancellation. Deterministic tests gate both reads and writes until the first cancellation has missed. The native package matrix now also compiles the adapter and stateful-allocator tests with MSVC AddressSanitizer; distributed libraries remain unchanged by test instrumentation. The workflow uses a typed CMake cache boolean, builds the required target first and verifies its fresh successful JUnit result, so legacy CMake option policies or a skipped/absent test cannot silently qualify the package. This configuration has a failing-before/passing-after native CMake probe.

Darwin can lose the EOF readiness notification when a FIFO writer closes. The stdin worker now bounds its idle select wait to one second and rechecks the nonblocking descriptor; data and cancellation still wake immediately. The change adds no worker, payload queue or runtime callback allocation. A compile-time wait policy supports deterministic fault injection without dynamic dispatch in the production path. The test suppresses FIFO readiness while retaining real cancellation readiness and requires successful EOF completion.

Package validation preserves all library/plugin configurations and supported Boost consumer versions. MSVC's optimized Boost1.83 external buffer diagnostic is scoped to affected application/test translation units; SDK warnings and optimization remain enabled. HTTP examples stage the same runtime plugins as the CLI. FIFO handler rejection preserves unlock-before-callback and notification. The early-exit TCP fixture half-closes and drains input instead of accidentally resetting the connection.

Validation: native Windows CTest50 and real routed ConPTY16/16 passed, with recorded source provenance for the larger native/network/previous-Go profiles. The optimized MSVC/Boost1.83 inventory compiled174 translation units; all4 remaining warning sites fail before and pass after with warnings-as-errors enabled. The Darwin EOF race is reproduced naturally with thread stacks; deterministic fault injection fails with the old unbounded wait and passes after the correction. Local ASan/UBSan55/55, TSan FIFO20 repetitions,250,000 pending-EOF repetitions and configured static analysis pass. The final Windows source was verified on Windows2022 with2,000 ConPTY executions,20 deterministic cancellation runs,20 adapter runs and20 native MSVCASan runs. Both Windows defects have failing-before/passing-after evidence; the stateful-allocator case reports heap-use-after-free before correction. Final Build and Reliability qualification passed: Build at fda51ae passed all 11 jobs, including all native library/plugin configurations; Reliability at 0ec2141 passed all 15 jobs with byte-identical runtime, C++ tests, CMake and sanitizer sources. Each Windows job executed four complete 49-test suites, four actual ASan tests and four fresh required JUnit verifications. The final change forces only the SDK build even with a populated Conan cache; an actual cache regression verifies all three native workflow commands. Dependency caching is preserved. Source qualification is complete.

Coordinated source delivery with Engine #144, Go #111, C++ #40, JS #76 and Next #47. All branches contain their verified respective main. Files PRs Go #105, JS #72 and Next #41, including the additional local files commits, are integrated; Next #42 is also included. Do not merge those superseded feature branches as separate implementations. SDK candidates remain unpublished and consumer lockfiles identify their exact archive bytes. Staging and release-artifact qualification remain separate from these source validations.