Split import.meta out of esm_loader.rs to clear the file-size gate

crates/pool/src/esm_loader.rs was already at 993 lines (not in the file-size baseline, so held to the 1,000-line limit); the import.meta work grew it to 1,379 and failed CI's File-size gate. Move the source-override remapping, the per-module preamble, resolve()'s backing implementation, and their unit tests into a new sibling module, esm_loader/import_meta.rs, matching the existing grants/graph_hash/ policy/resolver/transforms split. esm_loader.rs is back to 1,000 lines; behavior is unchanged (verified: all esm_loader::import_meta::tests::* and the two real-dsc end-to-end tests in crates/cli/tests/import_meta_runtime.rs still pass).

Merge pull request #1143 from dekaruntime/kimi/dependabot-alerts

chore(deps): bump parent crates for Dependabot alerts#1142

Merge pull request #1146 from dekaruntime/claude/bridge-drift-1145

fix(permissions): correct bridge declaration checker's Promise unwrap and Unit/Entries/error mapping

Add import.meta runtime values, url pointing at the original source file

Implements rfd#12's ESM alignment amendment for the runtime side of import.meta (deka#1139), pairing with dsc#282 on the compiler side:

• Every DekaScript/JS module the module loader (PhpxEsmLoader) serves gets a per-module preamble that overrides deno_core's host-provided import.meta object in place: url, dirname, filename derived from the module's real source path, main true only for the loader's own entry specifier (deno_core's own is_main_module is wrong here - deka run/serve always evaluate a loader-owned wrapper as the true V8 "main" module and dynamically import() the user's entry, so every DekaScript module reports main: false natively), a resolve() bound to the same lockfile-first resolver import statements use, and the object frozen last.
• resolve() is a native op (op_deka_import_meta_resolve) reached through the same frozen globalThis[Symbol.for('deka.host.internal')] gateway the RFD 27 host bridge already uses - the raw Deno.core.ops table stays unreachable from module code, matching that existing boundary.
• New PhpxEsmLoader::source_override / SourceOverrideHint: when this process executes a compiled or staged copy of the real source tree rather than the tree itself (a loose deka run file's user-cache artifact, or a deka build/deka dev staging directory), url/dirname/ filename report the original source, never the copy. The compiled tree mirrors the original's relative structure, so mapping back is strip-prefix + rejoin + recover the source extension.
• deka_cache::materialize_loose now also returns compiled_root/ original_root; command_run.rs installs the hint before dispatch reaches the isolate pool, mirroring deka_host::host_config's existing "first install wins" pattern but kept local to the pool crate (deka_host's runtime feature pulls in postgres/mysql/tokio-tls this crate's production build never needs otherwise).
• Islands/browser output is untouched: the override lives entirely in the server-side ESM loader; crates/pool/src/js_builtins/islands.rs was not touched.

Testing: 6 new PhpxEsmLoader unit tests (crates/pool/src/esm_loader.rs) cover entry vs imported-module identity, main true only for the entry, resolve() matching real import resolution, and the source-override remapping for both url/dirname/filename and resolve(). A new end-to-end CLI test (crates/cli/tests/import_meta_runtime.rs) runs real DekaScript through a real dsc built with dsc#282 (via IMPORT_META_TEST_DSC, tooling only - the test skips instead of failing CI until deka pins such a dsc) and asserts on actual V8 execution output for both a loose-run file and a project file, including that assigning to import.meta.url throws (the object is frozen). See PR body for full revert-and-run evidence.

refactor(permissions): split declaration-file rendering into host_decl.rs

host_bridge.rs crossed the 1,000-line file-size gate (deka#391) once the DirEntry/FsPermission/FsError declarations and error-type mapping were added for deka#1145. Move wire_type_to_ds, result_shape_to_ds, error_type_for_kind, host_decl, and their tests into a new host_decl.rs module; host_bridge.rs keeps owning the catalog data. No behavior change.

chore(deps): keep deno bumps, revert tao/wry (no CI coverage, no alert fixed)

Per review feedback: the tao 0.30->0.37 and wry 0.50->0.57 bumps are reverted because CI does not exercise the desktop/webview path and none of the four Dependabot alerts are fixed by those two bumps, so they carried upgrade risk with zero demonstrated benefit.

The deno_* bumps (deno_core 0.412, deno_napi 0.190, deno_permissions 0.118) are retained.

Merge pull request #278 from dekaruntime/kimi/client-directive-192

dsc#192: strip client:* directive attributes from emitted JSX props

Merge pull request #284 from dekaruntime/claude/import-type-281

import type (rfd#12 ESM alignment amendment)

Implement default exports and imports (rfd#12 ESM alignment amendment)

Parses export default fn Page() { … } / export default async fn … (reusing ExportDecl::Function with a new is_default flag; the local binding keeps its own name, exported under the sentinel key "default") and export default app, which desugars directly to the existing export { app as default } NamedGroup form — no new AST needed for the named-binding case, export { default as json } from "./json", or export { x as default }, since "default" was already an ordinary identifier token. Anonymous defaults (export default fn () {}, export default { … }) are rejected with a diagnostic that says to name it.

import X from "./m" and import X, { a } from "./m" desugar to an ImportSpec with imported="default", reusing the entire existing import pipeline (typeck registration, struct/opaque cross-module identity, shake liveness, hover) with the single sentinel key. A renamed default import warns (not errors) naming the declared name, via a new ModuleExports.default_export_declared_name field.

Emission keeps the source's own default-export/import syntax. LSP hover needed a targeted fix: its is_exported equality check compared the sentinel "default" against declared names, which never matched; replaced with a resolver that follows a default export back to its actual declaration. Go-to-definition does not exist anywhere in this codebase yet, so there is nothing for it to "follow"; rename already works via generic whole-word text matching, unaffected by is_default.

Item 7 (.d.ds accepts export default) is skipped: dsc#277 is still open.

Merge pull request #283 from dekaruntime/claude/typed-bridge-272

Type bridge calls from the deka host declaration file