host: wasip1 processes, wasi:http, identity, stdio options, services (T12)

- Core modules run on the host-side preview1 over the shared VFS (D41).
- wasi:http default handler in the linker; anonymous HTTPS git clone works.
  Sockets stay denied until P2.
- Each process carries the conversation (from Exec, inherited by children,
  shown in /proc/processes) and a host-assigned SAUSAGE_PID.
- Spawn requests choose pipe, inherit or null per stream.
- /config/services.yaml supervisor: live edits, restarts, crash limit 5/10 s,
  graceful stop (stdin EOF, then kill after 5 s) (D44).
- Compile caches keyed by content; PATH=/usr/local/bin:/bin.

world.rs also carries T13's optional read-only /bin mount (D43).

host/wit/process.wit

@@ -3,6 +3,7 @@ package sausage:process@0.1.0;
 /// Programs share one world. These resources provide lifecycle and bounded stdio transport.
 interface host {
     use wasi:io/streams@0.2.12.{input-stream, output-stream};
+    enum stdio { pipe, inherit, null }
     record request {
         program: string,
         argv: list<string>,
@@ -10,6 +11,9 @@ interface host {
         cwd: string,
         /// None inherits the parent's group. Zero creates a group. A nonzero ID joins a group.
         group: option<u32>,
+        stdin: stdio,
+        stdout: stdio,
+        stderr: stdio,
     }
     resource child {
         pid: func() -> u32;