Add native scripting APIs and managed resource cleanup

[lukewilliamboswell]

Basic-cli scripts currently need external tools for directory copying and temporary workspaces, and cannot retain listener ports or manage child-process pipes and deadlines. This adds native filesystem helpers, managed commands, TCP listeners, and monotonic timing for those workflows.

• Add file/tree copy policies, private temporary directories with scoped cleanup, and absolute/canonical paths.
• Add command working directories, spawn/run, configurable streams, bounded capture, interactive pipes, deadlines, and process-tree cleanup. Final Roc references release native resources, including existing file readers, TCP streams, and SQLite statements.
• Add practical examples for preparing a release directory and running a build. Keep ownership regressions in separate fixtures with a glibc/Valgrind CI check.

This changes the host ABI and prepares version 0.23.0. Existing command helpers share the new process engine; captured output now defaults to a combined 16 MiB budget. The compiler pin and generated glue are updated together. Contributor instructions refer to the pin rather than duplicating its value.

Validation: 51 Rust tests pass; generated glue is current; the full Linux source/build/native example suite and three glibc/Valgrind ownership fixtures pass. ARM Linux and both macOS hosts cross-build, and Windows GNU passes a compile check. Native macOS/Windows/ARM execution remains for CI.

Closes #484, closes #485, closes #486, closes #487, closes #488, closes #489.
Also addresses #440, #162, and #476.