feat(runtime): supervise resident component resources

Detect the resident actor export, route Host events through the bounded Actor mailbox, enforce fuel, deadlines, payload limits, and translate WIT effects into typed runtime values.

Add a revision-scoped ResidentSession with deny-by-default TCP, UDP, and Unix endpoint policies, non-reused resource IDs, stream lifecycle and backpressure state, atomic effect validation, timers, subscriptions, extension sources, and shutdown handling.

Cover passive rejection, real Component ABI round trips, resource ownership, endpoint policy, and driver operation validation with integration tests.

crates/wasmeld-runtime/src/error.rs

@@ -68,6 +68,18 @@ pub enum RuntimeError {
     #[error("actor for {0} stopped before returning a result")]
     ActorStopped(ServiceKey),
 
+    #[error("service revision {0} does not export the resident actor interface")]
+    NotResident(ServiceKey),
+
+    #[error("resident event for {service} exceeds the {limit}-byte payload limit")]
+    ResidentEventTooLarge { service: ServiceKey, limit: usize },
+
+    #[error("resident event for {service} returned more than {limit} effects")]
+    TooManyResidentEffects { service: ServiceKey, limit: usize },
+
+    #[error("invalid resident effect: {0}")]
+    InvalidResidentEffect(String),
+
     #[error("input for {service} exceeds the {limit}-byte limit")]
     InputTooLarge { service: ServiceKey, limit: usize },