refactor(host): isolate host-owned policies and async IO

[fffonion]

Summary

• move policy ownership out of VM core
• split blocking and async IO while preserving cancellation and resource semantics

Stack

Layer 9 of 14
Previous: #19
Next: #22

Validation

• cargo fmt --all -- --check
• cargo test --locked --workspace
• cargo test --locked --workspace --all-features
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo clippy --locked --workspace --all-targets --all-features -- -D warnings

[fffonion]

Superseded by #18 and #26. Host-owned policy/async IO moved to #18; HTTP-specific work moved to #26.