Fix host API type declarations flagged by the sound checker

[wolfy-j]

Summary

Align the host API declarations with the actual runtime contracts and close the runtime gaps exposed by the sound checker:

1. fs.FS:readdir now models the complete Lua generic-for protocol. It returns an optional iterator plus opaque iterator-state-or-error, the iterator accepts state/control arguments, and each step yields { name: string, type: "file" | "directory" }?.
2. Queue header values now have one stable Lua consumer contract across memory, AMQP, and SQS: Message:header() returns string?, and Message:headers() returns {[string]: string}. Drivers keep typed values internally for broker operations, while the Lua boundary normalizes numbers and booleans to strings, preserves binary attributes as raw Lua strings, and treats missing/nil values as absent.
3. Manager.AddNode retains a supplied host-module manifest so dependency alias imports, LSP dependency manifests, and builtin cache fingerprints can consume it.
4. process.set_options now declares its actual partial-update contract, while process.get_options retains the complete result shape.

The SQS and queue handlers now explicitly default a missing correlation_id, rather than hiding that valid nil path in the host declaration. The intentional undeclared-module fixture also uses a dynamic module name so the static application lint can complete while runtime scoping still rejects the undeclared json import.

Checker validation

The corrected declarations and call-site narrowing validate with the repository's published github.com/wippyai/go-lua v1.5.16; the target fixes do not depend on an unpublished go-lua checkout.

Source-backed strict lint over the complete test application reports:

Scope	Entries	Errors	Warnings	Hints
tests/app	597	0	0	0

Application-suite reliability

The application suite now binds its HTTP/WebSocket gateway to dedicated port 18085 and fails fast if that port is already occupied, preventing an unrelated local Wippy process from returning plausible but incorrect responses. Its external-service probes are bounded, and the Docker image dependency is checked before execution.

Tests

• tests/app/test.sh: 389/389 passed across 50 suites
  • Docker application tests ran successfully.
  • Network-overlay and SQS suites were skipped because their optional local services were absent.
  • Temporal and cloud-storage suites remain explicitly skipped by the existing script configuration.
• Source-backed wippy lint --json --cache-reset: 597 entries, 0 diagnostics
• go test -race ./runtime/lua/modules/process ./runtime/lua/modules/queue ./runtime/lua/modules/fs ./runtime/lua/code -count=1
• go test ./runtime/lua/... -count=1
• go test ./service/queue/... ./service/aws/sqs -count=1
• make lint: 0 issues

CI passes on Ubuntu and Windows, along with lint and CodeQL.