kiln-async v0.4.0: end-to-end run of a synth-lowered async core module (jess harness, synth#275)

[avrabe]

Tracks the Phase-1 exit for kiln-async: "runs a real synth-lowered async core module." The intrinsic surface is now functionally complete (task-control, future., task.wait/poll, stream.), and R1 is resolved — no unsafe (forbid(unsafe_code) is permanent; the scheduler uses an opaque poll-callback + mark_ready, never a Rust Future/Waker — see #316 / AD/SM-ASYNC-001).

What the exit needs (and what it doesn't)

• The Wasmtime wasm_run path (rules_wasm_component) tests the component itself, not kiln-async — kiln-async is the embedded host-intrinsic backing, not Wasmtime. So that path doesn't satisfy the exit.
• The kiln-async exit needs the synth→native→Renode leg: synth lowers a P3 async module to native (ARM) code that calls kiln-async's intrinsic surface (the way kiln-builtins backs other intrinsics), linked + run on Renode/QEMU.

Harness — reuse the established jess pipeline

Per jess (jess/BUILD.bazel): adopt_wasm_component → wasm_validate → meld_fuse → wasm_optimize (loom) → synth_compile (cortex-m4f) → renode_test. kiln-async slots in as the builtins/host-intrinsic library that the synth-compiled async module calls.

Dependencies (cross-tool — not closeable solely in kiln)

• synth: lower a P3 async module (task/future/stream intrinsics) to native code that calls the kiln-async ABI. (Coordinate; analog of how synth targets kiln-builtins.)
• synth#275 / jess: the renode_test leg (currently deferred in jess's BUILD).
• kiln-async: a thin C-ABI / extern surface exposing Scheduler::{poll_round, stream_*, future_*, task_*} for the synth-compiled module to call (the only remaining kiln-side code) + error-context intrinsic.

Acceptance

• A minimal P3 async module (e.g. a producer/consumer over a stream<T> with backpressure) synth-lowered, linked against kiln-async, runs to completion on Renode, with kiln-async driving the schedule.

Milestone: v0.4.0. Verification (Kani/Verus on the safe scheduler invariants) tracked separately (v0.7.0 / REQ_ASYNC_BENCH).

[avrabe]

Note on the kiln-side C-ABI surface (this issue's remaining kiln piece). It cannot live in kiln-async: an extern "C" surface over a stateful Scheduler needs raw pointers / static mut → unsafe, and kiln-async is #![forbid(unsafe_code)] (permanent, #316). So the FFI shim is a separate glue crate (e.g. kiln-async-ffi, analogous to how kiln-builtins is the FFI/host-intrinsic layer), where the unsafe boundary is isolated and can itself be Kani/MIRI-checked. Its exact ABI (handle = u32? result = error code? scheduler instance = caller-provided *mut?) should be agreed with synth before writing it — that's the cross-tool coordination this issue tracks.

Separately: the safe scheduler invariants are now Kani-proven (#319 — FSM totality/absorbing, ready-queue no-overflow, task-table ABA-safety; 3/3 verified). So the cert evidence for the scheduler core is in hand; the FFI crate is the remaining unsafe surface to verify when its ABI is settled.