mailbox S1 complete: embind lane, wheel lane, dual-contract specs

Shim embind lane wraps the doc-18 production mutators at the Module
boundary (busy-window calls queue + deliver post-settle; time-boxed
unkillable pump). N2 un-fixme'd and green; collab-load-fuzz carries the
variant contract (drop on legacy, deliver-in-order on scheduler, capped
hammer on the scheduler lane); timer-park's timerRetry silence tripwire
arms on shim+export and is green on the C-lane kicad build. Bump
wxwidgets for the wheel lane. CI both-EH matrix deliberately deferred.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TfxKn5utcntBSnxz4ZnYKs

tests/kicad/timer-park-repro.spec.ts

@@ -1,5 +1,6 @@
 import type { Page } from "@playwright/test";
 import { test, expect } from "./fixtures";
+import { expectGuardsSilent } from "./utils/guard-beacons";
 
 /**
  * Timer-park concurrent-Asyncify repro (gal-refresh-timer investigation).
@@ -311,6 +312,22 @@ test.describe("timer Notify() Asyncify-park during main-loop yield (concurrent c
     );
     expect(trapLines, "no wasm trap signature anywhere in the run").toEqual([]);
 
+    // Doc 17 S1 tripwire (arms itself when the wasm ships the C mailbox lane,
+    // detected via the wxWasmMailboxTick export): timers are then delivered
+    // from the mailbox only when the interlock is free, so the legacy 17 ms
+    // parked-retry path must be SILENT. On legacy wasm this is skipped — the
+    // retry storm there is expected and covered by the assertions above.
+    // Both halves must be present: the wasm export (C lane compiled in) AND
+    // the shim (variant injected) — a C-lane wasm on legacy glue keeps legacy
+    // timer semantics, and its retry storms are expected.
+    const cLane = await page.evaluate(
+      () =>
+        typeof (window.Module as unknown as { _wxWasmMailboxTick?: unknown })
+          ._wxWasmMailboxTick === "function" &&
+        !!(globalThis as unknown as { __wxScheduler?: unknown }).__wxScheduler,
+    );
+    if (cLane) expectGuardsSilent(testLogger.consoleLogs, ["timerRetry"]);
+
     // Window-engagement proof, independent of survival: the handlesleep shim
     // must have SEEN the concurrent parks (its reporting is new — silence here
     // means the lever never created the overlap and the repro is vacuous).