feat!: rebuild WeaveFFI on C ABI 4, one model, and library mode

[owenthcarey]

Summary

Engine v2: a pre-1.0 overhaul with no compatibility shims. Old code paths are deleted, not kept behind flags.

• Four crates. The published crates are weaveffi (facade plus the runtime as weaveffi::abi), weaveffi-macros, weaveffi-model, and weaveffi-cli (now a library plus the binary, absorbing the generators). weaveffi-abi and weaveffi-gen are removed.
• One validated model, schema 0.11.0.
  • validate(&Api, &Identity) builds a single Model once per run, and ResolvedApi is gone.
  • Names are global: types, free functions, and error codes are unique across the API.
  • Qualified type references are removed, and Ty::Prim wraps a single primitive enum.
  • Diagnostics point at the right span.
• C ABI revision 4.
  • Load-time checks: per-declaration contract tables replace per-module checksums, so adding a function no longer breaks older bindings.
  • Callbacks: vtables gain a {size, flags, free} header. Callback methods can return any type (allocated with {p}_alloc), throw typed domain errors with payloads, and be optional parameters.
  • Soundness fixes: safe code can no longer adopt a raw object token. Thunks adopt every input before reporting a failure. Duplicate map keys are rejected. Iterators never hold their lock across next(). The foreign-error unwinding machinery is removed.
  • Executor: a thread pool plus a tokio feature replace one thread per async call.
• Producer macro and library mode.
  • The macro runs the shared validator with real spans, honors item #[cfg], resolves type aliases, and emits much smaller thunks.
  • It embeds the API as metadata in the built library. generate, diff, validate, and extract build the crate and read that metadata, replacing the Rust source parser.
  • Also new: weaveffi dev and a Project library API.
• Generators.
  • The backend trait is slimmed, and the inert capability gate and hash cache are removed.
  • All 11 targets implement ABI 4, with one codec per composite type, a documented trap policy, and escaping for reserved member names.
  • Python drops its .pyi, Kotlin uses unsigned types, Node.js guards against callback deadlocks, and Dart loads natives relative to the package.
• Build and packaging.
  • weaveffi build cross-compiles per platform: @rpath install names, iOS static libraries, Android NDK detection, deployment targets, and prebuilt Node.js and JNI glue.
  • weaveffi package writes installable artifacts: wheels, npm tarballs, gems, NuGet packages, an XCFramework zip with its checksum, and C/C++ tarballs.
• Samples, tests, CI, docs.
  • Three samples: calculator; codec, with shared vectors; and a feature-complete kvstore.
  • Consumers in all 11 languages give 34 conformance lanes.
  • The snapshot corpus is about a third smaller.
  • Missing tools fail CI. The fuzz, bench, and release workflows are fixed, and there's a new package-install smoke job.
  • Every documentation page is updated, including a normative ABI 4 contract and migration notes in docs/src/stability.md.

Test plan

• Added or updated tests where appropriate (runtime, macro trybuild cases, model, CLI, per-target unit tests)
• Ran cargo insta test --workspace --check (passes), plus cargo clippy --workspace --all-targets -D warnings, cargo test -p weaveffi --features tokio, and the strict rustdoc build
• Reviewed and accepted intentional snapshot changes
• Updated documentation for user-facing changes
• PR title follows Conventional Commits
• CI=true bash scripts/check-fixtures.sh for all 11 targets (with mypy): passes
• bash conformance/run.sh: 34 passed, 0 failed, leak counters at zero
• bash scripts/package-smoke.sh: the packaged Python wheel, npm tarball, and Swift XCFramework each install and call add(2, 3)

Notes for reviewers

• Breaking everywhere, on purpose. Schema 0.11.0, ABI revision 4, and the CLI and config changes (crate input input = ".", a name override key, [build]/[package] dist; --force, --lenient, hooks, and [global] removed) are all covered in docs/src/stability.md.
• Generated-code churn. Snapshots changed for every target. The C header (snapshot_c) and docs/src/reference/abi.md are the best places to start reviewing.
• Known limitations (documented on the generator pages and the roadmap):
  • Dart: a value-returning callback invoked from a non-isolate thread aborts the process, because plain dart:ffi can't route it.
  • Node.js: a callback from another thread fails with -4 if the JS thread is blocked in one synchronous call for more than 1 s. This prevents a deadlock, but it also catches legitimately long synchronous calls.
  • C-style enums and interfaces must be declared in the module tree that uses them; the compiler gives a clear error otherwise.
  • Windows paths are compile-checked only. The packaged Kotlin Gradle project hasn't been built with Gradle.
• Not addressed: SECURITY.md still has its placeholder contact address.