esrun@0.40.0

Fixed

• The installers send GITHUB_TOKEN, when it is set, with their one GitHub
  API request (the release lookup). Unauthenticated, an address gets 60
  requests an hour, and a shared CI runner can find them spent: the JS
  workflow's setup-esdev step failed that way, and now passes the
  workflow's token. Release downloads never see the token.

• The postgres driver's environment test no longer dials a hardcoded port
  5433: it takes the test server's port from PGPORT, like the rest of the
  suite. CI serves postgres on 5432, so the two URL-precedence connects
  failed with connection refused there while passing locally.

• The Windows CI leg passes again. metrics_reports_the_whole_process
  allowed 1ms between the process's and the thread's CPU time, and on
  Windows the two are kept apart and advance in clock ticks; it now allows
  one tick there, and the runtime:diagnostics reference says so. The
  watch-restart test waits for the restarted run's output itself, and
  prints stderr when it is missing.

• The Windows build passes clippy -D warnings again: a listener backlog
  constant and a socket file's path, both used only on Unix, are compiled
  only there.

• Security dependency bumps with no API change: rustls 0.23.45 → 0.23.46
  (RUSTSEC-2026-0346 through RUSTSEC-2026-0349) and quinn-proto 0.11.16 →
  0.11.19 (RUSTSEC-2026-0338 through RUSTSEC-2026-0342).

• bench/db/run.sh launches esrun with --allow-all, like every other
  bench runner. Without it the esrun column failed on the imports
  permission before running a single query, so the SQLite benchmark had no
  esrun numbers at all.

Added

• runtime:path: toSlash(p), the forward-slash form of a path. On Windows
  a backslash becomes /; on POSIX the path is returned unchanged, because a
  backslash is part of a file name there. It is the form esdev gives a
  plugin's module ids, for comparing one with a path from runtime:fs or
  runtime:watch.

• One path interface (DECISIONS D165): every path, file: URL and module-id
  conversion in the workspace goes through default-providers' path
  module. A workspace clippy.toml refuses direct canonicalize and
  Url::from_file_path-family calls, and tsr path-discipline (run in CI)
  refuses the hand-written string forms.

• runtime:images exposes the otf-pixels 0.3.0 additions: resize
  position (nine gravities) and withoutReduction, modulate's
  lightness, the adjustments negate, gamma, linear, threshold,
  tint, greyscale, recomb, ensureAlpha and removeAlpha, named
  channels in extractChannel with layout-aware errors, and multi-page TIFF
  pages (new Image(input, { page }), metadata().pages). Names and
  defaults follow sharp where it has the operation; the documented
  divergences are gamma's single exponent (libvips' definition, not
  sharp's pair), threshold keeping the channel count, and greyscale
  keeping three channels where grayscale() makes one. The images guide
  has an adjustments section.

Changed

• CI no longer runs test (esdev with the inspector). tsr test:inspector
  stays, to run locally before changing --inspect or --coverage; CI's
  esdev suite checks only that those flags are refused in a build without
  the inspector.

• CI tests esrun and esdev in separate jobs on each OS (tsr test:esrun,
  tsr test:esdev; tsr test still runs both). A failure in one no longer
  hides the other's result, and each job keeps its own build cache, saved
  even when its tests fail. rust-cache saves only after a passing job, so the
  Linux leg, which had not passed since early October, had no cache and
  rebuilt the whole tree on every run.

• The esrun CLI test suites run outside Cargo too. Every path they need
  (the binary under test, a scratch directory and the fixture tree) comes
  from one tests/common module, which reads ESRUN_TEST_BIN,
  ESRUN_TEST_TMPDIR and ESRUN_TEST_MANIFEST and otherwise uses Cargo's
  own paths, as before. The Windows build of the suites runs that way in a
  Windows guest, where the paths baked in at compile time do not exist.

• runtime:images now runs on otf-pixels 0.3.0 instead of 0.2.0: JPEG
  decoding is about twice as fast with identical output, progressive JPEG
  is decoded in-house (opening one reads only its headers, and the
  published crates have no dependencies outside the Pixels workspace), and
  the tile worker pool no longer uses crossbeam. The image and workloads
  benchmark rows were re-measured on this build through bench/publish.sh.

• runtime:db's SQLite engine (turso_core) moves from the 0.8.0
  pre-release to stable 0.8.3: final 0.8.0 with MVCC concurrent writes no
  longer experimental, full window-frame support and TransactionBehavior
  concurrency in the Rust bindings, plus the 0.8.1–0.8.3 MVCC and sync
  fixes. No API change on this side — the engine is used through one
  module — and the 28 database CLI tests and 386 provider tests pass
  unchanged. The benchmarks page gains the SQLite section it was missing,
  measured on this build through bench/db/run.sh against Node, Bun and
  Deno.