net: implement ListenConfig with explicit option limits

[yohimik]

ListenConfig.Listen and ListenPacket currently return a not-implemented error. This stops callers that use a zero ListenConfig even though the netdev can listen.

Use the existing TCP and UDP listen paths. Check context before and after address lookup, before a socket is created. Reject Control and explicit TCP keep-alive settings with an error that wraps errors.ErrUnsupported. UDP ignores TCP keep-alive settings. The netdev has no raw socket control hook. It also has no lookup cancellation hook, so a lookup in progress must return before cancellation is reported. Default socket options and MPTCP fallback stay as provided by the existing netdev.

This replaces the local fork patch 895d524. That patch ignored context and Control. The new tests fail on that patch for both cases.

Validation uses released TinyGo 0.43.0-net.1, Go 1.26.7, and an isolated TINYGOROOT with this net tree. No LLVM build is required. Five tests pass on Linux arm64 and Linux amd64. The amd64 tests ran under emulation on an arm64 host. Tests cover a real TCP exchange, UDP receive, listening after context cancellation following creation, netdev delegation, cancellation before and during lookup, expired context, and rejected options. The native tests use getsockname directly to stay independent of #80. Test processes had an external 20-second timeout. Run tools/test-listenconfig.sh with a released compiler to build the tests in an isolated root.

The Crier record describes the original listener failure and a historical Linux arm64 run with 142 passing tests. That run used local listener, shutdown, and cookiejar patches. It predates later Crier changes. It is not validation of this branch or of a new Crier release.

Related work and scope

• net: non-blocking host netdev I/O with an epoll poller #77 owns Linux close cancellation and deadline interruption. This PR does not change socket close or the poller.
• net: report the kernel-assigned port after listening on port 0 #80 owns the bound TCP port. This PR does not change address reporting.
• net: API-compat fills for grpc and wazero (SyscallConn, Dialer.Control, IPConn.Read) #78 owns Dialer.Control API fields and other API additions. ListenConfig is a separate API and this PR does not implement raw socket control.
• net/http: add ListenAndServeTLS / ServeTLS (software TLS) #79 owns server TLS methods. http: port Go net/http timeout handling #67 owns Client.Timeout and transport selection.
• net/http: follow redirects in the client again #72–75 cover client redirects, DNS errors, darwin sockets, and darwin client trust roots.
• runtime: deliver os/signal notifications under the threads scheduler tinygo#5631 is closed in favor of runtime: deliver signals under the threads scheduler when blocked on I/O tinygo#5530 for signal delivery.

This PR is based on net main. It needs no change from those PRs to build or to run these Linux tests.

Current integration status

Darwin fcntl work is in tinygo-org/tinygo#5612. tinygo-org/tinygo#5632 is closed and remains a history reference only. The integer and pointer tests were offered on #5612. Builder socket and spawn symbols in tinygo-org/tinygo#5636 are an independent prerequisite at e8394f67. The direct syscall test needs no net update, so that PR does not wait for this net series. tinygo-org/tinygo#5634 is limited to process support.

Current Crier evidence

The Crier report separates the original size comparison from a new CI-built candidate test. The original stripped Linux ARM64 result is 13,829,248 bytes versus Go's 30,277,794 bytes. Two render fixtures exceed pixel tolerance.

Candidate e7d34c8c126e0eecd2ce711915f2f88d112d833a, with net 0f460803, passed all 24 fork CI checks. Its downloaded compiler artifacts, with no source overlays, build unchanged Crier 7edaff9. Linux ARM64 E2E passed 143 cases with no failures or skips. Darwin ARM64 passed 142 with no failures and one platform trust-store skip. Darwin startup now works. A separate Darwin local-TLS matrix passes certificate rejection, plaintext refusal, update to a Go 1.1.0 target, and offline rollback. Both platforms pass spawn, signal, cookiejar, os/fcntl, and network probes.

These are combined-candidate results, not proof that this PR alone supplies all features. No new pixel or stripped-size comparison, amd64 execution, or current Dispat acceptance is claimed. WaitDelay and the recorded net limits remain open. No fork release was published.