Add world.in.read stdin capability

[WalterGropius]

Summary

• Adds world.in.read(buffer: MutSpan<u8>) -> usize as the public process stdin surface on the World capability. 0 signals EOF; the call is infallible (no check needed).
• Introduces a separate stdin target capability so non-host targets cannot quietly inherit stdin. Host (darwin-arm64) and runnable cross host (linux-musl-x64) declare it; other targets reject world.in.read at check time with TAR002.
• Ships the zero_world_read runtime shim alongside zero_world_write so native exe emission can call into it once code-gen wiring follows.

Source

Addresses P1-8; salvaged after a prior agent run was interrupted by usage limits; reproduced against main @ 999a46b. Acceptance is check-level per the orchestrator's CARRY-FORWARD note (native exe wiring deferred).

Changes

• Parser: contextual keyword in admitted after . so world.in.read(...) parses without removing in as a loop keyword.
• Checker: new is_world_stream_read_callee / is_world_stream_read_call predicates, World.in resolves to WorldStream, read returns usize, single MutSpan<u8> argument enforced, helpful diagnostics for arity and arg type.
• Capabilities: CapabilitySummary.stdin is set on any program that calls world.in.read, surfaced in requiresCapabilities, and gated by validate_target_capabilities (TAR002, repair id choose-target-with-required-capability).
• Targets: stdin added to darwin-arm64 and linux-musl-x64 in targets.manifest and the matching fallback strings in target.c; capability listings updated.
• Runtime: zero_world_read(fd, buf, len) mirrors zero_world_write (EINTR-loop, byte count, no allocation); header + embedded_runtime_sources.inc regenerated via scripts/embed-runtime-sources.mts.
• Docs: docs/articles/modules/io.md lists world.in.read; docs/articles/target-capabilities.md documents the stdin capability and the rejection example for non-host targets.

Conformance

• conformance/native/pass/world-stdin.0 — host check-level fixture (added to the zero check loop in conformance/run.mjs).
• conformance/check/fail/target-stdin-unsupported.0 — rejected on linux-arm64 (lacks stdin); new assertion in conformance/run.mjs mirrors the existing target-net-unsupported / target-proc-unsupported pattern and matches the TAR002 diagnostic with /lacks stdin/.

Gates locally:

• make -C native/zero-c clean
• ZERO_NATIVE_TEST_ALLOW_LOCAL=1 node conformance/run.mjs -> conformance ok
• node scripts/snapshot-command-contracts.mts -> command contract snapshots ok
• node scripts/provenance-guardrails.mts -> provenance guardrails ok (29 surfaces)
• type-core-smoke, mir-verifier-smoke, row-syntax-smoke, native-smoke all green
• native:test:local cross step omitted (environmental: zig / cross cc missing here, byte-identical against unmodified origin/main).

Capability gating verified: zero check --target linux-musl-x64 passes on the stdin fixture; zero check --target linux-arm64 rejects with TAR002 and lacks stdin.

Native exe wiring (lowering world.in.read to the new zero_world_read symbol in the macho64 / elf64 / coff backends) is deliberately not in this PR; check-level support and the runtime shim land first so the surface and gating can be reviewed before the codegen patches.

Proposed CHANGELOG line

• Add world.in.read(buffer) and the stdin target capability for process input under explicit capability control.

[vercel]

@WalterGropius is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

Struct field bool stdin; in CapabilitySummary conflicts with the C standard macro stdin from <stdio.h>, causing compilation failure.