Upgrade the shared SDK dependency tuple for Auctioneer #467

Purpose

Deliver the coordinated EdgeZero prerequisite for IABTechLab/auctioneer#165. The user explicitly approved a separate SDK upgrade first on 2026-11-11. This is new work after the closed toolchain-refresh issue #365, not a request to reopen it or edit another implementer's checkout.

Scope

Prepare a reviewed, isolated upgrade of the SDK-owned dependency tuple before Auctioneer takes corresponding updates. The candidate must preserve #275's retained outbound HTTP, bounded collection/decoding, deadline, cancellation, completion, header/raw-JSON and resource-ownership contracts. Do not switch consumers to unrelated main and lose those APIs. Coordinate the base/stack with #275's owner; do not mutate its active worktree or branch. An integration branch is not a stable release or deployed-provider qualification.

Observed constraints at #275 head b97efec185abbaa901e633a980975c98ef2f6c3b:

These are audit observations, not a qualified tuple. Refresh source/registry inventory at implementation selection, freeze one exact tuple and report any constraint rather than claiming a partially updated decoder is complete. Spin's eager spawned-task progress repair #169 is merged upstream; tag presence alone does not prove ABI, HTTP/body conversions or runtime progress. Preserve narrow SDK features rather than enabling broad defaults.

Acceptance

• Review a spec and ordered SDK implementation plan before coding; identify the carrying base and preserve the outbound contract lineage.
• Refresh root and excluded/generated-consumer dependency graphs and version emitters affected by these shared requirements. Keep shared requirements workspace-owned and .tool-versions authoritative.
• Migrate provider/shared-type boundaries without incompatible duplicate exposed HTTP/body types. Record every retained old package instance and its owning upstream constraint.
• Preserve codec framing, truncation, window, cancellation/cleanup and bounded-allocation controls against the new source tuple. Do not relax tests, limits, resource ceilings or capability/readiness claims.
• Prove Spin eager-progress and completion/lifetime behavior on the selected maintained source; compile and execute the existing guest controls and provider packaging checks where prescribed.
• Run the full SDK prescribed matrix and generated-consumer/demo checks at the exact proposed revision, with commands, exit codes and real result lines. Missing hosted prerequisites are explicit blockers, never passing evidence.
• Deliver an immutable revision in IABTechLab/edgezero with dependency/source identities and review evidence for Auctioneer adoption. SDK and Auctioneer remain separately reviewed changes; neither is merged by this issue's authorization.

Downstream Boundary

Auctioneer retains responsibility for its own vendor patches, Unicode 16 migration, cookie compatibility, configuration/compiler/resource controls and full four-adapter matrix. Its single-copy codec source guard cannot simply be weakened to permit an upgraded encoder beside an old decoder. This task is a dependency prerequisite, not a claim that Auctioneer or all deployment targets are qualified.