loader: include the standard HTTP cookie jar

[yohimik]

Review status: ready for review. The independent head 99279a31 passed all 24 fork CI checks, and published-fork Crier acceptance is complete. GitHub denied the ready-for-review action for the current account on 6 September. A user or maintainer with permission must change the draft flag. No Dispat or Crier test hold remains.

Problem

The net/http directory override hides Go's net/http/cookiejar package. Crier imports it through its client dependencies. Its TinyGo build currently needs a manual copy into TINYGOROOT.

Change

Merge the net/http directory while keeping the TinyGo HTTP implementation and all its existing subpackage overrides. This exposes Go's pure cookie jar package without a vendored copy. There is no change to the netdev, transport, TLS selection or HTTP redirects.

This is independent of #5635 and tinygo-org/net#72 through #82. A source merge with #5635 must retain its additional pathsToOverride argument. No commit from those PRs is included here.

Tests

The loader test checks that HTTP files and the existing httptest and internal subpackages still come from TinyGo, while cookiejar comes from Go. A host test stores a secure cookie and checks that it is not returned for an HTTP URL.

The merge test passed in a small harness using the exact production merge functions. The cookie test passed with ordinary Go on Darwin arm64. Full local loader tests could not build because LLVM development headers are not installed. Fork CI at 99279a3 passed all 24 checks. See Linux, macOS, and Windows. This verifies the independent branch. Full Crier acceptance subsequently passed with published TinyGo net.2 and shipped in Crier v1.1.1, as recorded below.

CI found that the Nix job initialized musl and bdwgc but not src/net. The HTTP merge needs that source directory. Commit 99279a3 adds src/net to that job's existing submodule checkout. The Nix rerun passed at 99279a3. The earlier failure is not counted as a pass.

Published fork and downstream evidence

The net.2 fork release combines the coordinated changes at 95fba82a, with net 0f460803. It differs from accepted candidate e7d34c8c only in the version constant. Linux, macOS and Windows branch CI and tag CI passed on their first attempts.

Dispat source 909dc401, with harness 0990c6db, passed 796 test events with no failures or skips on each native Darwin ARM64 and Linux ARM64 candidate run. Crier source 7d687fc8 passed raw and stripped E2E on native Linux ARM64 and emulated Linux AMD64, each with 144 top-level tests and 156 passing events, no failures or skips. Both applications use TinyGo-built update fixtures and test trusted TLS, certificate refusal, original backup hashes and byte-identical offline rollback. Their workflows also exercise files, environment variables, concurrency and child processes. Crier includes real FFmpeg and webrender/canvas rendering.

Crier's unchanged 13-image pixel gate passed. It uses an approved two-line explicit-rounding webrender build patch for both compilers. The earlier gradient mismatch was permitted fused arithmetic, not a TinyGo compiler error. Candidate stripped sizes are 13,835,824 versus 30,277,794 Go bytes on ARM64 (54.30% smaller), and 16,446,968 versus 32,518,306 on AMD64 (49.42% smaller).

These are combined-candidate application results, not proof that this PR alone supplies the features. They supersede the earlier Crier comparison. Published-toolchain probes and application acceptance have since completed. The final Crier v1.1.1 release evidence is below. Dispat controls its own publication. WaitDelay, in-flight deadlines and full descriptor lifetime remain open. This enables tested CLI client workflows, not general Go or server compatibility.

Published Crier v1.1.1 evidence

Crier v1.1.1 is public at source acac2f0e and uses published TinyGo 0.43.0-net.2. Its final acceptance report and SHA-256 manifest identify the exact release bytes. The public tag, asset sizes and report digest were checked. These final sizes supersede the candidate sizes above.

Linux target	Standard Go bytes	Stripped TinyGo bytes	Reduction
ARM64	30,277,794	13,835,840	54.30%
AMD64	32,518,306	16,447,000	49.42%

The report records 144 top-level tests and 156 passing events for each raw and stripped run on native ARM64 and emulated AMD64, with no failures or skips. It covers real CLI files, environment and concurrent work, child processes, TLS, update/rollback fixtures, uploads, real FFmpeg, and webrender/canvas rendering. The unchanged 13-image gate passes on both targets. AMD64 is exact; ARM64 has 12 exact images and four event-card pixels with channel difference 1. Both compilers use the same explicit-rounding webrender build patch. Standard Go tests, 90.6% coverage, lint and docs also pass.

This is combined-fork application evidence, not isolated proof for this PR or general server support. The generic emulated AMD64 os closure assertions still fail and also fail with ordinary Go under that emulation; they are not counted as passing. Native AMD64 CI and the final published AMD64 net package pass. The report retains other platform and deadline/descriptor limits. Tiny binaries are opt-in; normal install/self-update selects standard Go assets.

Published Dispat v1.8.1 CLI evidence

Dispat v1.8.1 CLI is public. Its size and SHA-256 manifest records build source 40c58236, Go 1.26.8 and TinyGo 0.43.0-net.2. The public asset metadata and manifest digest were checked.

Linux target	Standard Go bytes	TinyGo bytes	Reduction
ARM64	9,896,098	6,299,032	36.35%
AMD64	10,895,522	6,697,528	38.53%

These are final published CLI asset sizes, not the earlier candidate measurements. They do not replace the separately identified test evidence or remove known runtime limits. The full release workflow has now completed successfully at the recorded build source, including its Windows, macOS and Ubuntu checks. This does not change the test and platform limits stated above.