refactor: type websocket host boundaries

[tiye]

Summary

• upgrade Calcit and @calcit/procs to 0.14.4, js-ffi to 0.1.16, and cumulo-util.calcit to 0.0.19
• model browser WebSocket, Node ws/HTTP, message data, and Date host access with explicit external-object traits
• keep unsafe host narrowing inside lexical js-ffi adapters and preserve existing client/server lifecycle behavior
• refresh the per-definition quality baseline after reducing typeNone 5→0, schemaDynamic 9→4, and unresolved 8→3; the documented unsafeCoerce 21→30 change makes formerly untyped host reads explicit and prevents further growth
• update strict-mode unit tests to avoid the legacy assert= macro boundary

Validation

• caps --strict --ci
• caps verify --toolchain
• yarn install --immutable
• default and server --check-only
• default and server dynamic-methods --max 0
• quality baseline PASS
• 4/4 unit tests; deprecated 0; README docs check
• page/server codegen and client-generation smoke
• Node 24.4.1 Vite production build
• one calcit.cirru; no compact.cirru

Tracks calcit-lang/calcit#856.