[P2][libs] expose documented crypto/gzip/url APIs in runtime and DSL signatures

[redpeacock78]

Summary

The native extension docs list crypto, gzip, and url libs, but the core runtime/DSL API surface needs explicit functions, signatures, graceful fallback behavior, and tests for each documented lib.

Evidence

• docs/libs.md lists libs/crypto, libs/gzip, and libs/url as planned/documented native extensions.
• hawk.awk loads core/libs.awk and the current runtime exposes several facade-style APIs such as cache.
• dsl/sig.awk must know public DSL function signatures for type checking.

Proposed feature

Add first-class facade APIs and DSL signatures such as:

• crypto.sha256(str) -> Str
• crypto.hmac_sha256(key, body) -> Str
• gzip.compress(str) -> BinaryStr|Str
• gzip.decompress(str) -> Str
• url.encode(str) -> Str
• url.decode(str) -> Result<Str, ParseError>

Names are suggestions; final naming should match H-awk namespace conventions.

Acceptance criteria

• Each documented native lib has a public runtime facade or is marked future-only in docs.
• DSL signatures exist for each public helper.
• Missing native libs degrade gracefully where possible or fail with clear errors when explicitly required.
• Unit tests cover native-present and native-missing paths.

Priority: P2
Area: libs/dsl/runtime
Type: feature