feat(server): workerd runtime profile and SDK workerd entrypoint

[kitlangton]

What

Adds a workerd runtime profile so an OpenCode server can boot inside a Cloudflare Durable Object, plus the SDK entrypoint and a CI guard that proves it in a real isolate.

The destination is one OpenCode server per Durable Object — a Slack bot where each thread is a DO hosting a full server, with OpenCode's database being the DO's own SQLite and no request leaving the isolate. That app lives on a local branch; this PR is the upstream half it needs.

Four pieces:

Piece	What it is
packages/server/src/workerd.ts	The profile: ServerWorkerd.create(options) returns the fetch handler for a DO's fetch(), with every intentionally-local service replaced
overrides threading	createRoutes / createEmbeddedRoutes / ServerFetch.make take runtime-profile replacements applied after the standard set, so later entries win
@opencode-ai/sdk-next/workerd	The embedded typed client over the workerd profile — same OpenCode.Interface, in-isolate transport
packages/workerd-spike	The purity guard: boots core inside real workerd via @cloudflare/vitest-pool-workers

The profile

• Database runs on the injected DurableObjectStorage SQLite (Database.layerFromClient over the merged workerd adapter).
• Native modules (#pty, #fff, #photon-wasm, #shell-parser-wasm, #process-lock-ffi) resolve to inert stubs under the workerd bundle condition; loopback OAuth servers import node:http lazily; @effect/platform-node is deep-imported so the barrel's eager undici / node:sqlite side imports never load.
• Watcher and fff are disabled through existing option flags; plugin discovery is precompiled-only (ConfigPluginSource.empty); MCP is remote-only.
• Shell, FileSystem, FileSystemSearch, Pty fail with a clear defect until a remote sandbox backs them; Snapshot and Vcs degrade to empty results, matching their behavior for locations without a supported VCS.
• Durable events are persisted unconditionally — that history is exactly what an evicted turn is recovered from, so a runtime that dies without teardown cannot opt out.
• Global roots every path under one writable directory (tmp on workerd), and health reports pid: 0 where the runtime has no OS process identity.

The spike (the heart of this PR)

packages/workerd-spike runs the full stack inside a real Durable Object, all five tests green:

1. Cold boot with all 42 migrations journaled on real DO SQLite, authed health 200 / unauthed 401.
2. Session create over the HTTP API, row persisted.
3. A complete prompt turn against a fetchMock'd OpenAI-compatible provider, read back through the durable session log cursor route.
4. A turn that completes with no request in flight (prompt, return, sleep, read) — the ack-then-continue shape the Slack flow needs.
5. Eviction mid-turn: DurableObjectState.abort() between prompt-accepted and turn-complete, then a fresh instance boots over the same storage, resumes the claimed execution, and replays the drain.

Test 5 is the interesting one. The durable log stays gapless across the isolate's death:

[1 session.input.admitted] [2 session.execution.started] [3 session.instructions.updated]
[4 session.input.promoted] ✗ EVICTED ✗ [5 session.synthetic] [6 session.execution.started]
[7 session.step.started] [8 session.text.started] [9 session.text.ended]
[10 session.step.ended] [11 session.execution.succeeded]

A consumer that checkpointed a cursor at seq 4 pre-eviction resumes at exactly 5 — no gaps, no duplicates. The second session.execution.started (seq 6) with no terminal event between is the replay signature a projection can key on.

How

The only new seam in shared code is the overrides parameter. ServerFetch.make stays eager — the layer builds in the caller's scope before the handler is returned, as merged in #41896; the profile does not reintroduce a lazy first-request build.

ServerWorkerd.create returns an Effect requiring a Scope. A Durable Object holds that scope for the instance's lifetime and never closes it, which is correct: a DO is evicted without teardown, and storage is durable.

Scope

Ported from a local seam branch validated months ago, re-adapted to current head. Several seam pieces turned out to be superseded by upstream work and were dropped:

• DO-SQLite adapter → merged (feat(core): sqlite driver for durable object storage #41659); this consumes Database.layerFromClient.
• Execution journal / suspendOnStart → merged (feat(core): discover AGENTS.md up to the home directory #41652, core: write-ahead execution claims replace shutdown-hook suspension #41800); the write-ahead claim is now unconditional, so the profile only opts into the boot-time resume.
• PluginSupervisor.configured({ dynamic: false }) → superseded by ConfigPluginSource.empty.
• ModelsDevcontent / cache options → superseded by the embedded snapshot + KV cache (c254ba8); head's models-dev is already workerd-safe (no flock, no disk).
• Co-tenant table fix, supportsForeignKeyToggle, migration defer_foreign_keys → already in v2.
• The seam's lazy toWebHandlerLayerWith fetch entry → superseded by the eager ServerFetch.make in feat(server): web-standard fetch handler entry #41896.

One deliberate deviation: sdk-next keeps building its own routes rather than consuming ServerFetch.make. The embedded path needs the built context (for SdkPlugins registration and the logging context added since the seam) and uses password-less embedded auth, so routing it through ServerFetch.make would regress log capture and change auth semantics. It gains the same overrides + resumeSuspendedSessions hooks instead.

Testing

• packages/workerd-spike: 5/5 pass in a real workerd isolate (vitest-pool-workers).
• packages/server: 22 pass — the ServerFetch tests from feat(server): web-standard fetch handler entry #41896 stay green, plus a profile test over a bun:sqlite-backed fake DO storage.
• packages/sdk-next: 13 pass. packages/core: 1681 pass.
• Repo-wide bun typecheck: 32/32 green. check:generated clean for both client and www.
• script/workerd-probe.ts (bun run probe:workerd): the graph bundles under the workerd condition with no bun builtins statically imported. The probe now distinguishes static from dynamic imports, so a lazily-loaded bun:sqlite behind a runtime guard (the v1 legacy-database reader) is reported as (lazy) rather than failing.

Two CI caveats, neither from this branch:

• unit (windows) is broken at v2 head itself (three directoryAutocompleteSearch path-separator tests); a fix is in flight separately.
• The spike is registered as a turbo test task so it actually runs in CI on both matrix legs — turbo test only runs the tasks declared in turbo.json, so without that entry the guard would never fire. It pins @cloudflare/vitest-pool-workers 0.12.6 (newer pool/workerd pairings segfault on macOS) with a patch extending the stale workerd builtin allowlist and fixing fallback-service handling of case-insensitive filesystems, /@fs ids, JSON requires, and unanchored module-rule globs. Worth watching its first run on the Linux and Windows runners; if the pool proves unreliable on Windows, the task can be scoped to Linux.