Merge loops/fed-prims into architecture: fed-sx host primitives (Phases A-I)

Pure-OCaml WASM-safe crypto/CID surface + native HTTP server:
- crypto-sha256/sha512 (FIPS 180-4), crypto-sha3-256 (FIPS 202)
- cbor-encode/decode (deterministic dag-cbor), cid-from-bytes/from-sx (CIDv1)
- ed25519-verify (RFC 8032), rsa-sha256-verify (PKCS#1 v1.5, RFC 8017)
- file-list-dir (native-safe), http-listen (native-only, bin/sx_server.ml)
Unblocks Erlang Phase 8 BIFs (erlang-on-sx.md blocker -> RESOLVED).
Merged: build green, 63 crypto tests pass, WASM boot OK, http test 6/6,
Erlang conformance 715/715, no regression.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

plans/erlang-on-sx.md

@@ -255,4 +255,18 @@ _Newest first._
 
 - **Phase 9a — Opcode extension mechanism** — **RESOLVED 2026-05-15.** User widened scope to include hosts/ (merging back anyhow). Cherry-picked vm-ext phases A-E + force-linked `Sx_vm_extensions` into sx_server.exe. `extension-opcode-id` live; conformance 709/709. Remaining integration work (erlang_ext.ml + wiring the SX stub dispatcher to consult real ids) tracked as ordinary in-scope checkboxes now, not blockers.
 
-- **SX runtime lacks platform primitives for crypto / dir-listing / HTTP / SQLite** (2026-05-14). Probed in `mcp_tree.exe`'s embedded `sx_server.exe`: `(sha256 "x")`, `(blake3 "x")`, `(hash "sha256" "x")`, `(file-list-dir "plans")`, `(http-get "url")`, `(fetch "url")` all return `Undefined symbol`. Only file-byte-level primitives exist: `file-read` ✓, `file-write` ✓, `file-delete` ✓, `file-exists?` ✓. Out-of-scope to add these (they live in `hosts/` per ground rules). Blocked Phase 8 BIFs: `crypto:hash/2`, `cid:from_bytes/1`, `cid:to_string/1`, `file:list_dir/1`, `httpc:request/4`, `sqlite:open/exec/query/close`. **Fix path:** a future iteration on the architecture branch can register host primitives (e.g. expose OCaml's `Digestif` for hashes, `Sys.readdir` for list_dir, `cohttp` for httpc); the BIF wrappers here will then become one-line registrations against `er-bif-registry`.
+- **RESOLVED (2026-05-18) — SX runtime now exposes the platform
+  primitives Phase 8 BIFs need.** Delivered by `loops/fed-prims`
+  (see `plans/fed-sx-host-primitives.md` Handoff). Pure-OCaml,
+  WASM-safe except `http-listen` (native only). Wire Phase 8 BIFs:
+  - `crypto:hash/2` → `crypto-sha256` / `crypto-sha512` /
+    `crypto-sha3-256` (each `(bytes) -> hex-string`).
+  - `cid:from_bytes/1` → `cid-from-bytes` `(codec mh-bytes)`;
+    `cid:to_string/1` / canonical CID → `cid-from-sx` `(value)`;
+    dag-cbor via `cbor-encode` / `cbor-decode`.
+  - signature verify → `ed25519-verify` `(pk msg sig)` and
+    `rsa-sha256-verify` `(spki msg sig)` — both total (→ false).
+  - `file:list_dir/1` → `file-list-dir` `(path) -> (list string)`.
+  - fed-sx transport → `http-listen` `(port handler)` (native only).
+  Still deferred (leave blocked): `httpc` (HTTP client, v2) and
+  `sqlite-*` (v2 indexes) — not provided by fed-prims.