net: implement ListenConfig with explicit option limits

[yohimik]

ListenConfig.Listen and ListenPacket currently return a not-implemented error. This stops callers that use a zero ListenConfig even though the netdev can listen.

Use the existing TCP and UDP listen paths. Check context before and after address lookup, before a socket is created. Reject Control and explicit TCP keep-alive settings with an error that wraps errors.ErrUnsupported. UDP ignores TCP keep-alive settings. The netdev has no raw socket control hook. It also has no lookup cancellation hook, so a lookup in progress must return before cancellation is reported. Default socket options and MPTCP fallback stay as provided by the existing netdev.

This replaces the local fork patch 895d524. That patch ignored context and Control. The new tests fail on that patch for both cases.

Validation uses released TinyGo 0.43.0-net.1, Go 1.26.7, and an isolated TINYGOROOT with this net tree. No LLVM build is required. Five tests pass on Linux arm64 and Linux amd64. The amd64 tests ran under emulation on an arm64 host. Tests cover a real TCP exchange, UDP receive, listening after context cancellation following creation, netdev delegation, cancellation before and during lookup, expired context, and rejected options. The native tests use getsockname directly to stay independent of #80. Test processes had an external 20-second timeout. Run tools/test-listenconfig.sh with a released compiler to build the tests in an isolated root.

The Crier record describes the original listener failure and a historical Linux arm64 run with 142 passing tests. That run used local listener, shutdown, and cookiejar patches. It predates later Crier changes. It is not validation of this branch or of a new Crier release.

Related work and scope

• net: non-blocking host netdev I/O with an epoll poller #77 owns Linux close cancellation and deadline interruption. This PR does not change socket close or the poller.
• net: report the kernel-assigned port after listening on port 0 #80 owns the bound TCP port. This PR does not change address reporting.
• net: API-compat fills for grpc and wazero (SyscallConn, Dialer.Control, IPConn.Read) #78 owns Dialer.Control API fields and other API additions. ListenConfig is a separate API and this PR does not implement raw socket control.
• net/http: add ListenAndServeTLS / ServeTLS (software TLS) #79 owns server TLS methods. http: port Go net/http timeout handling #67 owns Client.Timeout and transport selection.
• net/http: follow redirects in the client again #72–75 cover client redirects, DNS errors, darwin sockets, and darwin client trust roots.
• runtime: deliver os/signal notifications under the threads scheduler tinygo#5631 is closed in favor of runtime: deliver signals under the threads scheduler when blocked on I/O tinygo#5530 for signal delivery.

This PR is based on net main. It needs no change from those PRs to build or to run these Linux tests.

Current integration status

Darwin fcntl work is in tinygo-org/tinygo#5612. tinygo-org/tinygo#5632 is closed and remains a history reference only. The integer and pointer tests were offered on #5612. Builder socket and spawn symbols in tinygo-org/tinygo#5636 are an independent prerequisite at 6fded0c9. The direct syscall test needs no net update, so that PR does not wait for this net series. tinygo-org/tinygo#5634 is limited to process support.

Published fork and downstream evidence

The net.2 fork release combines the coordinated changes at 95fba82a, with net 0f460803. It differs from accepted candidate e7d34c8c only in the version constant. Linux, macOS and Windows branch CI and tag CI passed on their first attempts.

Dispat source 909dc401, with harness 0990c6db, passed 796 test events with no failures or skips on each native Darwin ARM64 and Linux ARM64 candidate run. Crier source 7d687fc8 passed raw and stripped E2E on native Linux ARM64 and emulated Linux AMD64, each with 144 top-level tests and 156 passing events, no failures or skips. Both applications use TinyGo-built update fixtures and test trusted TLS, certificate refusal, original backup hashes and byte-identical offline rollback. Their workflows also exercise files, environment variables, concurrency and child processes. Crier includes real FFmpeg and webrender/canvas rendering.

Crier's unchanged 13-image pixel gate passed. It uses an approved two-line explicit-rounding webrender build patch for both compilers. The earlier gradient mismatch was permitted fused arithmetic, not a TinyGo compiler error. Candidate stripped sizes are 13,835,824 versus 30,277,794 Go bytes on ARM64 (54.30% smaller), and 16,446,968 versus 32,518,306 on AMD64 (49.42% smaller).

These are combined-candidate application results, not proof that this PR alone supplies the features. They supersede the earlier Crier comparison. Published-toolchain probes and application acceptance have since completed. The final Crier v1.1.1 release evidence is below. Dispat controls its own publication. WaitDelay, in-flight deadlines and full descriptor lifetime remain open. This enables tested CLI client workflows, not general Go or server compatibility.

Owner sync, 6 September

The owner of #77 adopted our repeated-Close guard as 9dc11e1, with tests adapted to its nonblocking sockets. The owner of #80 adopted the Zone correction as 7b7aacb and removed the test dependency on #82. These are PR branches, not upstream merges.

New #83 restores RoundTripper dispatch. A Git merge check against #72 reports a conflict in http/client.go; both behaviors need combined tests before integration. New #84 uses the existing integer-conversion shim in tlssock.go. Neither new PR is included in the tested candidate e7d34c8c. No duplicate PR is needed.

Published Crier v1.1.1 evidence

Crier v1.1.1 is public at source acac2f0e and uses published TinyGo 0.43.0-net.2. Its final acceptance report and SHA-256 manifest identify the exact release bytes. The public tag, asset sizes and report digest were checked. These final sizes supersede the candidate sizes above.

Linux target	Standard Go bytes	Stripped TinyGo bytes	Reduction
ARM64	30,277,794	13,835,840	54.30%
AMD64	32,518,306	16,447,000	49.42%

The report records 144 top-level tests and 156 passing events for each raw and stripped run on native ARM64 and emulated AMD64, with no failures or skips. It covers real CLI files, environment and concurrent work, child processes, TLS, update/rollback fixtures, uploads, real FFmpeg, and webrender/canvas rendering. The unchanged 13-image gate passes on both targets. AMD64 is exact; ARM64 has 12 exact images and four event-card pixels with channel difference 1. Both compilers use the same explicit-rounding webrender build patch. Standard Go tests, 90.6% coverage, lint and docs also pass.

This is combined-fork application evidence, not isolated proof for this PR or general server support. The generic emulated AMD64 os closure assertions still fail and also fail with ordinary Go under that emulation; they are not counted as passing. Native AMD64 CI and the final published AMD64 net package pass. The report retains other platform and deadline/descriptor limits. Tiny binaries are opt-in; normal install/self-update selects standard Go assets.

Published Dispat v1.8.1 CLI evidence

Dispat v1.8.1 CLI is public. Its size and SHA-256 manifest records build source 40c58236, Go 1.26.8 and TinyGo 0.43.0-net.2. The public asset metadata and manifest digest were checked.

Linux target	Standard Go bytes	TinyGo bytes	Reduction
ARM64	9,896,098	6,299,032	36.35%
AMD64	10,895,522	6,697,528	38.53%

These are final published CLI asset sizes, not the earlier candidate measurements. They do not replace the separately identified test evidence or remove known runtime limits. The full release workflow has now completed successfully at the recorded build source, including its Windows, macOS and Ubuntu checks. This does not change the test and platform limits stated above.