Add real std.proc.run process API (host runtime)

[WalterGropius]

Summary

Replaces the no-op std.proc.spawn fiction with a real process API. std.proc.run executes an argv vector (no shell) with three pipes, captures stdout/stderr into caller buffers, feeds stdin, and SIGKILLs on timeout. Returns a ProcResult u64 handle with exitCode / outLen / errLen / timedOut accessors. Legacy spawn/exitCode are preserved.

Source

Addresses P0-4. Reproduction confirmed against main @ 5b91e7f: ir.c lowered std.proc.spawn to the integer literal 0 and ran nothing (docs-site/articles/modules/proc.md described it as merely "creates a process status"). std.proc.run/ProcResult did not exist anywhere at HEAD.

Changes

• native/zero-c/runtime/zero_runtime.c + include/zero_runtime.h: zero_proc_run_result (fork + execvp + 3 pipes, non-blocking poll drain, SIGKILL on timeout) and packed-handle accessors. POSIX impl + Windows/unavailable fallback. No stub.
• native/zero-c/src/embedded_runtime_sources.inc: regenerated.
• checker.c / ir.c / include/zero.h / main.c: ProcResult type, signatures for run/outLen/errLen/timedOut, IR value kinds + lowering modeled on std.http.fetch, helper registry + explain metadata.
• docs-site/articles/modules/proc.md: rewritten for the argv-vector API and host-only / calling-convention gating.
• conformance/native/pass/std-proc-run.0 + conformance/run.mjs: fixture exercising echo capture, error-exit, and timeout flags; registered in the type-check set (matching the existing host-only proc fixture).

Conformance

• zero check passes for the new fixture and all touched fixtures (legacy spawn std-platform-basics.0, std-http-fetch.0, the target-proc-unsupported fail test, examples/std-platform.0) — no regressions.
• std.proc.run is correctly host-only: non-host targets reject with TAR002 (capability proc), exactly as spawn does today. The fixture is registered in the type-check set like the existing host-only std-platform-basics.0 (no runtime loop, since proc is host-only and the host --emit exe path is itself CGEN004-unsupported on the direct backend).
• Dependency note: the runtime entry takes nine register-width args (4 byte views + timeout), which exceeds the direct backends' argument-register limit. Native-exe execution of std.proc.run therefore depends on the extended calling convention (aggregate-ABI work) landing. The host runtime, type surface, and conformance coverage here are complete and correct.
• Full conformance:local / native:test:local / docs:test could not be executed in the build sandbox (pnpm/harness invocation denied; docs:test additionally needs typescript workspace deps installed). Reviewer should run these locally; individual zero check gates were verified manually.

Proposed CHANGELOG line

• Add std.proc.run(argv, stdin, out, err, timeout) -> ProcResult with real shell-free process execution and stdout/stderr capture; std.proc.spawn retained for compatibility.

Note

A parallel agent worktree holds the feat/std-proc-run branch with an equivalent runtime/wiring implementation on a newer base but missing the docs + conformance fixture. This PR is pushed under feat/std-proc-run-host to avoid clobbering that branch; the docs/fixture/registration here are the complementary deliverables. Maintainers may prefer to consolidate.

🤖 Generated with Claude Code

[vercel]

@WalterGropius is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.

[WalterGropius]

Local machine verification (darwin-arm64, clean build of native/zero-c, no warnings):

• zero check --json conformance/native/pass/std-proc-run.0: ok: true, languageOk: true, no diagnostics. This fixture is intentionally host check-only (same as std-platform-basics.0): native-exe execution of std.proc.run is blocked on separate aggregate-ABI work (9 reg-width args exceed the current direct-backend limit), so targetReadiness.buildable: false (CGEN004) is expected and not a regression.
• No regressions: legacy std-platform-basics.0 (spawn/exitCode) and std-http-fetch.0 still check clean.
• Host-only gating enforced: --target linux-musl-x64 correctly rejects with TAR002 ("target does not provide required Proc capability").
• zero graph --json exposes the new std.proc.run plus exitCode/outLen/errLen/timedOut accessors.
• Gates: pnpm run conformance:local -> ok (29 surfaces); pnpm run command-contracts:local -> ok.
• pnpm run native:test:local fails only at the pre-existing --target linux-musl-x64 cross-compile step (no cross C compiler / zig installed). Verified byte-for-byte identical failure on unmodified origin/main, so this is environmental, not a regression from this PR.

Gating signals (conformance + command-contracts) are green. Marking ready.

[vercel]

Exit code sign extension lost in 8-bit packing: zero_proc_run_exit_code returns 255 instead of documented -1 for timeout/spawn-failure cases.