Fix bounded host HTTP transport for PHP.wasm

[chubes4]

Summary

• add a GET-only host HTTP transport with runtime network-policy enforcement, host-side DNS intersection, public-IP pinning, response limits, and absolute cancellation
• expose it through both direct PHP message listeners and a token-protected local preview route for worker-backed Playground runtimes
• inject a PHP helper into wordpress.run-php and wordpress.ability without exposing the route token to runtime inputs

Closes #2258.

Verification

• npm run build
• npm run test:host-http-transport (5 tests)
• npm run test:browser-provider-bridge-inheritance
• downstream Shopify acceptance crossed the previous empty bridge response, discovered 80 routes, and cached 19.3 MB across 149 network misses; the larger workload exhausted its continuation budget before final acceptance gates

AI Assistance

OpenAI GPT-5.6 Sol via OpenCode was used to trace the backend capability mismatch, implement the transport and tests, and analyze acceptance evidence. Chris Huber reviewed and remains responsible for the change.