fix: bump WebKit for stack retention and Linux suspension

[steipete]

What does this PR do?

Pin all ten archives from the immutable OpenClaw WebKit stack-retention and Linux-suspension release. Engine #24 initializes native VM entry storage and deferred microtask scope state that could retain otherwise unreachable objects. Engine #25 releases the global suspension lock between refused optional trap samples on foreign native stacks, allowing another VM's collector to progress while Worker termination remains pending. Mandatory GC suspension and Mach suspension retain their contracts.

The manifest is byte-for-byte identical to the published manifest, so engine identity, archive URLs and checksums move together. WEBKIT_VERSION derives from this file. Consumers rebuild against matching headers and libraries; no new Bun adapter is needed. The other changes are the changelog and compatibility notes, matching the previous bump's scope.

This branch starts at d5e2ee84ab8baf4b413aa13c8e8ba219236b4366 and includes Bun #145, #151, #152, #153, #154 and #156. The rebase preserves both appended changelog entries and the merged ALS fixture exactly. WebKit #28 and #29 are outside this engine batch. Thanks @robobun for the related whole-word storage remedy in oven-sh/WebKit#694 and collected-realm fixture work in oven-sh#44544.

How did you verify your code works?

The single protected WebKit publication run passed all 15 jobs: ten archive builds, Linux engine and Bun qualification, native Windows ARM64, assembly and publication. Paired Bun results pass 46/46 in each arm; feature-sync passes 85/85; compatibility startup and all three memory-release tests pass. Independent unauthenticated readback verified all fourteen public files, GitHub asset digests, SHA256SUMS/manifest coverage, immutability, tag/source binding, exact release notes, recipe settings and forty provenance files. The three new patch hashes match source, with the publication clone's nine-character Git index abbreviations; the 38 historical patch records match the prior immutable manifest.

Independent P2 review is scoped-clean for the rebased diff. Native CI passed on Linux x64 and macOS ARM64 for 1bba95eab88c2a634ff5ba5517bf70ff221040c4: 47/47 Linux and 52/52 macOS result rows. Retained artifacts confirm ALS and VM were selected and passed on both platforms; both independent net checks passed. The synthetic merge tree equals the reviewed head tree, and retained executables and runtime receipts bind it to the intended engine. Rust CI passed all four jobs: Clippy/all-targets, Miri, lol-html and Mordant. Format, JavaScript lint and source lints passed. Not ready: Windows dry run failed x64 compatibility. Both architectures built and passed native smokes; ARM64 compatibility passed 31/31 result rows. x64 passed 30/31 rows, with test/js/node/fs/fs.test.ts failing only the two recursive fs.promises.readdir cases (with and without withFileTypes), each timing out at its existing 10-second limit. Both independent Windows net checks passed and recorded this exact head and engine. Manifest and Publish were skipped. The failed job log was fetched once; both reports and all four Windows test archives/executable hashes were retained and verified.

The previous candidate passed Windows with the same runtime, build-system and engine sources; only the ALS test and changelog differ after this rebase. The failing fixtures perform two batches of 200 concurrent recursive directory reads per case in release builds. This classifies the observation as a Windows x64 test timeout, with cause unresolved; it does not establish a harmless intermittent or clear the engine pin. No test assertion, timeout, skip or runtime source was changed, and no workflow/test rerun was requested. This PR remains draft for that unresolved gate. This is a changed-input qualification after #156, with no manual retry of the original failed run.

The original native run failed only the HTTP/2 ALS fixture on Linux and macOS: stdout CLEARED, exit 1. Before changing the fixture, twenty complete-file runs per binary on macOS failed identically on the published bf099 old-engine binary, #154's old-engine CI binary (tree identical to main a683), and the new-engine candidate. Exact-child stderr was error: boom at emitError → emitSessionCloseNT. #144 had deferred the session error beyond the fixture's synchronous catch; #144 and #154 CI selections both omitted ALS. Separate #156 explicitly observes the exact deferred error while preserving the CLEARED, clean-exit and no-AssertionError assertions. The same three binaries each passed 20/20 after that correction, and #156's native Linux/macOS CI passed. All outcomes were retained. The comparison matrix ran on macOS; fresh CI qualifies both platforms.

The earlier head a133c820890417d011dade8e3025031923be6894 passed a local macOS release build, 22 manifest/Windows configuration tests, the VM suite (340 pass, 3 existing skips, 60 existing todos) and seven Worker-destruction tests. That historical local proof remains separate from the rebased head's fresh CI.

The engine's original Koffi proof remains 66 timeouts/200 processes before versus 200/200 passes after, with a matched native negative control. ASAN passed with its standard swapcontext warning. TSAN was not clean: all eight reported signatures also appeared on an unpatched two-VM GC control, without suppressions. This bump does not claim a new run of that matrix or race freedom; the release notes preserve those limits.

No Bun tag, Bun release, or OpenClaw consumer pin is included.

[steipete]

CLASSIFIED_INTERMITTENT — known Windows x64 recursive-readdir intermittent, recorded per the CI known-failure policy.

Controlled attribution of the two 10-second failures in run 38018158966, at head 1bba95eab88c2a634ff5ba5517bf70ff221040c4: 20/20 passes for each case on each of three binaries (120/120 case executions total). Both candidate binaries have essentially the same distributions as the old-engine control.

Binary	withFileTypes	n / fail	Min (s)	Median (s)	p90 (s)	p95 (s)	Max (s)
1bba95 (#155 head)	false	20 / 0	4.166	4.210	4.269	4.278	4.296
1bba95 (#155 head)	true	20 / 0	4.254	4.309	4.355	4.363	4.443
a133 (previous #155 head)	false	20 / 0	4.170	4.216	4.271	4.281	4.392
a133 (previous #155 head)	true	20 / 0	4.248	4.302	4.382	4.406	4.536
42bd (old-engine CI control)	false	20 / 0	4.168	4.219	4.252	4.273	4.300
42bd (old-engine CI control)	true	20 / 0	4.207	4.304	4.409	4.489	4.555

Same Windows Server 2025 x64 host, NTFS volume, and frozen test tree; eight logical CPUs, Defender enabled. Twenty rounds rotated binary order across all six permutations. Each invocation selected only the two existing fs/promises recursive-readdir “should work x 100” cases, preserving the warmup plus 200 concurrent reads and their explicit 10,000 ms limits. All 6,409 Node-tree file hashes matched before and after. Case durations come from JUnit; raw per-process logs and all 120 case durations are retained.

The current head's median differences against the old-engine control are −0.22% without withFileTypes and +0.11% with it. The previous head's medians differ by less than 0.08%. Every maximum is below 4.56 s; the overall slowest case belongs to the old-engine control. This supports a timing-sensitive Windows runner/test intermittent, not a material slowdown from the bump in these cases. The experiment does not identify which CPU, storage, antivirus, or full-suite scheduling condition made the original CI runner cross 10 s.

Control provenance correction: the published openclaw-v1.4.3-20261008-42bd1d282a-webkit-cb8d6f202b release has no Windows assets; its manifest and SHA256SUMS list only Linux/macOS. The old-engine control was therefore the retained, unsigned test-only Windows x64 artifact for the exact 42bd1d282ad16189ff71789ddbf81fa89dcd9d3a commit from run 37759883671, verified against its archive/executable hash receipt. It is a CI control, not a published Windows release binary. The other arms are the retained binaries from 38018158966 and 38006845939. Runtime self-reports verified their exact commits and respective 01f208ae7a / cb8d6f202b engines.

No engine, fixture, assertion, iteration count, skip, or timeout was changed. No CI rerun or redispatch was requested, and the original failed run remains visible. This is attribution evidence, not a green CI replacement or a change to this PR's draft state.