fix(runtime): report TCP broadcast write failures with -1 and errno

[slepp]

Why

hew_tcp_broadcast_except silently swallowed per-recipient write failures: a dead peer, a failed stream clone, or a partial write left the loop with continue and the function still returned a success-shaped recipient count. The try_broadcast_except wrapper in std/net/net.hew already declared an n < 0 → NetError path, but the runtime could never produce a negative return, so callers had no way to observe delivery failures.

What

• runtime: every eligible recipient is still attempted (best-effort delivery preserved), but the first failure's message and OS errno are now recorded. The failure data is built as owned values inside the TCP table lock and emitted to the thread-local error sink after the lock is released. The return is tri-state: -1 when any eligible recipient failed (errno recorded), 0 when there were zero eligible recipients, delivered count otherwise. All three failure branches (stream clone, body write, newline write) feed the same accounting.
• std/net: doc comments on try_broadcast_except / broadcast_except now describe the tri-state contract and the failure mapping; no behaviour change in the wrappers — the existing NetError path simply fires now.

Test

Five new regression tests in hew-runtime/src/transport.rs, run in isolated processes where they mutate process-global state (SIGPIPE disposition, RLIMIT_NOFILE):

• broadcast_all_recipients_failed_returns_minus_one_with_errno — deterministic peer RST, asserts -1 + non-zero errno
• broadcast_partial_failure_returns_minus_one_and_still_delivers — one dead + one healthy peer; healthy peer receives the full frame, return is -1
• broadcast_clone_failure_records_errno_and_message — fd-limit-induced clone failure, asserts the clone-branch message prefix + errno
• broadcast_zero_eligible_recipients_returns_zero — pins 0 (clean no-op) as distinct from -1, no errno recorded
• broadcast_success_returns_delivered_count — happy-path count unchanged

Each failure assertion (== -1 + recorded errno) is unproducible by the old code, which could only return recipients >= 0.

Quality Checklist

• PR title, body, and commit messages avoid internal-only orchestration/model vocabulary
• No new .ok()? or unwrap_or_default() in codegen without // JUSTIFIED comment
• New allocations have cleanup paths for sync, async, and actor shutdown contexts
• Serialization changes include round-trip encode/decode tests (n/a — no serialization changes)
• New runtime features have WASM implementation or // WASM-TODO(#NNN): marker, and new hew_* exports are classified in scripts/jit-symbol-classification.toml (no new exports; existing symbol's return semantics documented)
• No duplicated logic — checked for existing helpers before adding new ones (errno recording mirrors hew_tcp_write)

Out of scope

• Broadcast writes still happen under the global TCP table lock; moving the write loop off-lock is a broader change to the table's ownership model.
• A partial body write can leave half a frame in a recipient's stream (pre-existing; the failure is now at least reported).
• hew_tcp_write, hew_tcp_close, and the reactor paths are untouched.

Fixes #2657