build+core: move onto core-cpp v0.2.1 -- CPM, timers, base64, wakeup, and coroutines on core::async

[christianparpart]

Tracking issue for moving morph onto core-cpp v0.2.1, the shared C++23 foundation of the Contour Terminal projects. Everything lands as one branch, build/core-cpp, and one pull request, in this commit order. Each commit is green on its own.

1. build: fetch dependencies with CPM instead of FetchContent
   • glaze, Catch2, doxygen-awesome-css and both Lightweight sites go through CPMAddPackage, using core-cpp's pinned cmake/CPM.cmake (0.40.8 plus its SHA-256).
   • cmake/DepCache.cmake is replaced by CPM's CPM_SOURCE_CACHE, which defaults to .cache/cpm.
   • ci.yml, wasm-ladder.yml and wasm-demo.yml cache that directory.
2. core: TimeoutScheduler is one implementation over core-cpp's event-loop timers
   • core-cpp v0.2.1 comes in through CPM, linking core::base, core::async and core::net, plus core::platform natively.
   • TimeoutScheduler becomes one class:
     • natively, a thread running a core::net::PlatformLoop;
     • under single-threaded WebAssembly, a host-driven PlatformLoop with no thread.
   • The public API is unchanged. cancel() still releases the callback's captures immediately, and in the browser it now also retires the timer.
3. net: base64 and the wakeup pipe come from core-cpp
   • morph/net/detail/base64.hpp is replaced by core::base64.
   • SocketServer's nested WakeupPipe is replaced by core::platform::Wakeup.
4. Coroutine support on core::async, spec first (docs/spec/core/coroutines.md):
   • Completion<T> is awaitable, via operator co_await() &&;
   • morph::async::spawn and morph::async::delay;
   • Task-returning model handlers are driven on the model's strand through StrandCoroExecutor;
   • then tests, the implementation, and one bank or ladder action plus one GUI flow converted as a demonstration.

Constraints

• morph's public surface stays header-only. Its consumers now also build core-cpp's static libraries, which the README and docs/ARCHITECTURE.md will say.
• Single-threaded WebAssembly (Qt wasm_singlethread, emsdk 3.1.56) must keep working. wasm-ladder and wasm-demo then compile core-cpp's WebAssembly subset.
• The wire protocol and the remote backends are unchanged.

Verification status. Nothing is measured yet; this issue is filed before the work starts. The pull request will carry a gate table covering:

• Windows MSVC (vcpkg preset);
• WSL GCC 15 and Clang;
• the CI legs, including wasm-ladder and wasm-demo.

What would change this plan: a gap in core-cpp's API, or in its WebAssembly subset, that morph would have to work around. Any such gap is reported to core-cpp and fixed there, not patched here.

[christianparpart]

Two gaps in core-cpp v0.2.1 turned up while doing this. Both are with the core-cpp side to fix there; morph does not work around either.

1. No install()/export (core-cpp#5). morph's INTERFACE target now links core::base, core::async, core::net and core::platform. With MORPH_INSTALL on — the default when morph is the top-level project — the configure fails at generate. Measured on WSL with GCC 15, at the commit that adds core-cpp:

CMake Error in CMakeLists.txt:
  install(EXPORT "morphTargets" ...) includes target "morph" which requires
  target "core-cpp-base" that is not in any export set.
(the same for core-cpp-async, core-cpp-net and core-cpp-platform)
CMake Generate step failed.

Local verification runs therefore pass -DMORPH_INSTALL=OFF. The install-export job cannot pass until core-cpp exports its targets and morphConfig.cmake can find_dependency(core-cpp).

2. A host-driven PlatformLoop destroyed while a host pump is outstanding is a use-after-free.

• HostDrivenBackend hands emscripten_async_call its own this, and a browser timer cannot be retracted.
• ~EventLoop clears the pump, but PlatformLoop then frees the backend, and the pending timer later writes into it.
• This affects the single-threaded WebAssembly TimeoutScheduler, which is destroyed with its Bridge or RemoteServer.
• Reproduced natively under ASan: HostDrivenBackend over testing::ManualHostScheduler, destroyed after arming and cancelling a 30 s timer, then pumped.

pending host callbacks before teardown: 1
pending host callbacks after teardown: 1
ERROR: AddressSanitizer: heap-use-after-free ... 48 bytes inside of 64-byte region

What would change this: a core-cpp release that fixes either gap, followed by a pin bump here.