[codex] expose subtle encapsulation method surface

[andrewtdiz]

Summary

Refs #2518.

This PR adds the WebCrypto SubtleCrypto encapsulation method surface:

• exposes encapsulateBits, decapsulateBits, encapsulateKey, and decapsulateKey on SubtleCrypto.prototype
• routes crypto.subtle namespace property reads and captured method calls to callable runtime thunks
• matches Node 26 method name, length, descriptor shape, Promise-returning missing-argument rejections, and captured-call ERR_INVALID_THIS
• adds explicit unsupported-operation stubs so reached execution paths reject with NotSupportedError instead of falling through as missing methods

Why batched

The four helpers share the same SubtleCrypto prototype installation, crypto.subtle namespace property-read path, captured-call receiver validation, and stdlib WebCrypto dispatch surface. Splitting them would duplicate the runtime plumbing and leave the method family in a partially reflective state.

Tests

Added test-parity/node-suite/crypto/webcrypto/encapsulation-method-surface.ts, covering:

• method presence on crypto.webcrypto.subtle
• SubtleCrypto.prototype descriptor shape
• method name and length
• direct and captured omitted-argument Promise rejections
• bare captured-call ERR_INVALID_THIS
• explicit unsupported algorithm rejection

Validation

• npm exec --yes --package=node@26 -- node --experimental-strip-types test-parity/node-suite/crypto/webcrypto/encapsulation-method-surface.ts
• cargo check -p perry-runtime -p perry-stdlib
• PERRY_NO_AUTO_OPTIMIZE=1 npm exec --yes --package=node@26 -- bash -lc './run_parity_tests.sh --suite node-suite --module crypto --filter encapsulation-method-surface'
  • report: /root/perry-worktrees/perry-node-crypto-subtle-encapsulate-surface/test-parity/reports/parity_report_20260603_192724.json
• PERRY_NO_AUTO_OPTIMIZE=1 npm exec --yes --package=node@26 -- bash -lc './run_parity_tests.sh --suite node-suite --module crypto --filter global-webcrypto-globals'
• PERRY_NO_AUTO_OPTIMIZE=1 npm exec --yes --package=node@26 -- bash -lc './run_parity_tests.sh --suite node-suite --module crypto --filter subtle-supports'
• CARGO_TARGET_DIR=/tmp/perry-subtle-encapsulation-crypto-check cargo check -p perry-stdlib --no-default-features --features crypto
• cargo fmt --all -- --check
• git diff --check
• ./scripts/check_file_size.sh

Known limitations

This does not implement ML-KEM encapsulation or decapsulation. Calls that reach the new execution stubs reject explicitly as unsupported.

Non-goals

• no ML-KEM key generation or shared-secret implementation
• no changes to SubtleCrypto.supports() reporting
• no P-384/P-521, Ed448/X448, AES-OCB, ChaCha20-Poly1305, KMAC, or Argon2 WebCrypto algorithm work