Sync Holepunch modules to current clone/npm latest

Bump published pins (compact-encoding 3, bare-fetch/tls/https/ws 3,
bare-subprocess 6, bare-signals 5, corestore 7.12, protomux 3.11,
hypercore-crypto 3.7, bare-runtime 1.31) and regenerate catalogs,
manifests, and kernel/seeder bundles.

Adapt call sites to the new APIs:
- Corestore: explicit session flush before suspend(); treeCache ctor opts
- bare-crypto: KeyObject.export() instead of removed ._key
- Protomux 3.11: wait for fullyOpened()/fullyClosed() on chat channels
- bare-fetch: surface response.type and Headers.getSetCookie
- host snapshots: bare-os 3.9 / bare-posix / bare-fs.statfs frsize
- bare-subprocess 6: optional IPC channel + json serialization

Keep catalog sync from wiping curated pearEntries. Teach the Node test
shim to stub bare-thread/bare-worker (ESM absolute paths) and chain
Bare.on so bare-timers can load. Booter 479, protocol 34, seeder 14.

packages/bare-os-coreutils/lib/agent-web-fetch.js

@@ -12,7 +12,8 @@ function bareWebFmtErr(e) {
   if (typeof e !== 'object') return String(e)
   const o = /** @type {Record<string, unknown>} */ (e)
   const msg = o.message
-  if (typeof msg === 'string' && msg.trim()) return bareWebFmtErrAugment(o, msg.trim())
+  if (typeof msg === 'string' && msg.trim())
+    return bareWebFmtErrAugment(o, msg.trim())
   if (typeof msg === 'number' || typeof msg === 'boolean')
     return bareWebFmtErrAugment(o, String(msg))
   const nm = o.name
@@ -28,7 +29,8 @@ function bareWebFmtErr(e) {
   const cause = o.cause
   if (cause !== undefined && cause !== null && cause !== e) {
     const cs = bareWebFmtErr(cause)
-    if (cs && cs !== 'unknown_error') bits.push('cause=(' + cs.slice(0, 280) + ')')
+    if (cs && cs !== 'unknown_error')
+      bits.push('cause=(' + cs.slice(0, 280) + ')')
   }
   const errs = o.errors
   if (Array.isArray(errs) && errs.length) {
@@ -44,7 +46,10 @@ function bareWebFmtErr(e) {
     /* ignore */
   }
   try {
-    if (typeof (/** @type {{ toString?: () => string }} */ (o)).toString === 'function') {
+    if (
+      typeof /** @type {{ toString?: () => string }} */ (o).toString ===
+      'function'
+    ) {
       const t = /** @type {{ toString: () => string }} */ (o).toString()
       if (t && t !== '[object Object]') return t.slice(0, 400)
     }
@@ -65,14 +70,17 @@ function bareWebFmtErrAugment(o, base) {
   const errno = o.errno
   /** @type {string[]} */
   const tail = []
-  if (typeof syscall === 'string' && syscall.trim()) tail.push('syscall=' + syscall)
-  if (code !== undefined && code !== null && String(code) !== '') tail.push(String(code))
+  if (typeof syscall === 'string' && syscall.trim())
+    tail.push('syscall=' + syscall)
+  if (code !== undefined && code !== null && String(code) !== '')
+    tail.push(String(code))
   if (errno !== undefined && errno !== null && String(errno) !== '')
     tail.push('errno=' + String(errno))
   const cause = o.cause
   if (cause !== undefined && cause !== null) {
     const cs = bareWebFmtErr(cause)
-    if (cs && cs !== 'unknown_error') tail.push('cause=(' + cs.slice(0, 240) + ')')
+    if (cs && cs !== 'unknown_error')
+      tail.push('cause=(' + cs.slice(0, 240) + ')')
   }
   return tail.length ? base + ' [' + tail.join(', ') + ']' : base
 }
@@ -264,7 +272,10 @@ function bareWebCharsetFromContentType(ct) {
  */
 function bareWebDecodeBytes(bytes, label) {
   try {
-    const dec = new TextDecoder(label || 'utf-8', { fatal: false, ignoreBOM: true })
+    const dec = new TextDecoder(label || 'utf-8', {
+      fatal: false,
+      ignoreBOM: true
+    })
     return dec.decode(bytes)
   } catch {
     return new TextDecoder('utf-8', { fatal: false }).decode(bytes)
@@ -325,13 +336,13 @@ function bareWebExtractLinks(html, baseUrl, maxLinks) {
   const seen = new Set()
   /** @type {string[]} */
   const out = []
-  const re =
-    /<a\b[^>]*\bhref\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi
+  const re = /<a\b[^>]*\bhref\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi
   let m
   const h = String(html || '')
   while ((m = re.exec(h)) !== null) {
     const href = (m[1] || m[2] || m[3] || '').trim()
-    if (!href || href.startsWith('javascript:') || href.startsWith('#')) continue
+    if (!href || href.startsWith('javascript:') || href.startsWith('#'))
+      continue
     try {
       const abs = uBase ? new URL(href, uBase).href : new URL(href).href
       const proto = new URL(abs).protocol
@@ -369,8 +380,7 @@ function bareWebExtractMeta(html) {
     ? bareWebDecodeHtmlEntities(titleM[1].replace(/<[^>]+>/g, ' ')).trim()
     : ''
   let description = ''
-  const metaDescRe =
-    /<meta[^>]*\bname\s*=\s*["']description["'][^>]*>/i.exec(h)
+  const metaDescRe = /<meta[^>]*\bname\s*=\s*["']description["'][^>]*>/i.exec(h)
   if (metaDescRe) description = bareWebMetaContent(metaDescRe[0])
 
   let og_title = ''
@@ -378,8 +388,7 @@ function bareWebExtractMeta(html) {
   if (ogT) og_title = bareWebMetaContent(ogT[0])
 
   let og_description = ''
-  const ogD =
-    /<meta[^>]*\bproperty\s*=\s*["']og:description["'][^>]*>/i.exec(h)
+  const ogD = /<meta[^>]*\bproperty\s*=\s*["']og:description["'][^>]*>/i.exec(h)
   if (ogD) og_description = bareWebMetaContent(ogD[0])
 
   return {
@@ -600,6 +609,17 @@ async function bareWebRunTool(o) {
 
     const ct = res.headers.get('content-type') || ''
     const url_final = currentUrl
+    const responseType = typeof res.type === 'string' ? res.type : undefined
+    let setCookie
+    try {
+      const hdrs = res.headers
+      if (hdrs && typeof hdrs.getSetCookie === 'function') {
+        const sc = hdrs.getSetCookie()
+        if (Array.isArray(sc) && sc.length) setCookie = sc.slice(0, 32)
+      }
+    } catch {
+      setCookie = undefined
+    }
 
     if (method === 'HEAD') {
       return {
@@ -607,6 +627,8 @@ async function bareWebRunTool(o) {
         url_final,
         status: st,
         content_type: ct,
+        response_type: responseType,
+        set_cookie: setCookie,
         redirect_chain: redirectChain.length > 1 ? redirectChain : undefined,
         truncated: false,
         extract: { note: 'HEAD — body omitted' }
@@ -615,7 +637,11 @@ async function bareWebRunTool(o) {
 
     let bodyRead
     try {
-      bodyRead = await bareWebReadBodyLimited(res, maxBytes, signal || undefined)
+      bodyRead = await bareWebReadBodyLimited(
+        res,
+        maxBytes,
+        signal || undefined
+      )
     } catch (e) {
       const msg = bareWebFmtErr(e)
       return {
@@ -644,7 +670,9 @@ async function bareWebRunTool(o) {
 
     if (fmt === 'json') {
       const p = bareWebMaybeParseJson(text)
-      extract = p.ok ? { json: p.value } : { parse_error: true, text_slice: text.slice(0, 8000) }
+      extract = p.ok
+        ? { json: p.value }
+        : { parse_error: true, text_slice: text.slice(0, 8000) }
     } else if (fmt === 'links') {
       extract = bareWebExtractLinks(text, url_final, maxLinks)
     } else if (fmt === 'meta') {
@@ -674,6 +702,8 @@ async function bareWebRunTool(o) {
       url_final,
       status: st,
       content_type: ct,
+      response_type: responseType,
+      set_cookie: setCookie,
       redirect_chain: redirectChain.length > 1 ? redirectChain : undefined,
       truncated: bodyRead.truncated,
       extract,