HowlFrame #90 Phase 2a: mediate env on Go and JavaScript

[howlcipher]

Phase 2a only

This is the Motoko slice for improvement #90 Phase 2a: generated Go and JavaScript mediate (env) the same way the interpreter and the bytecode VM already do. It is not the rest of Phase 2. Do not merge as a claim that #90 is Done.

What changed

• (env key) in generated Go and JavaScript goes through howlFrameEnv.
• The runner grant is HOWLFRAME_ALLOW_CAPS (comma-separated, the same names as -allow-caps).
• An empty grant, an unset grant, or a grant that omits environment is CAPABILITY_DENIED before os.Getenv or process.env[key]. The secret is not printed.
• The environment grant returns the value.
• tests/conformance/lowered_hfir_abi_v1.json covers denial and the granted case on the interpreter, the bytecode VM, Go, and JavaScript.
• Journal: docs/journals/2026-09-30_lowered_hfir_abi_phase2a_env.md.
• #90 stays Partial. Phase 2a is Done. Phase 2 remains.

Explicitly not in this PR

• No flip of production -compile-bc onto the HFIR lowerer.
• No ControlEdges, CFG, or SSA.
• No call / while on the experimental lowerer.
• No Wasm growth and no Wasm execution.
• No module linker.
• No new capability kind.
• Other generated host effects (read_file, exec, and the rest) are still unmediated.

Tests

gofmt -l is clean, go vet ./... is clean, and go test ./... passes, including the ABI conformance cases for env denial and the granted read.

  

[howlcipher]

COMMENT OK (Motoko) on head d5524cb — Phase 2a only; #90 stays Partial.

Scope check

• Go + JS (env) → howlFrameEnv; empty/missing/HOWLFRAME_ALLOW_CAPS without environment → CAPABILITY_DENIED before os.Getenv / process.env[key]; grant returns value; no secret in stdout/stderr/crash.
• Conformance: env_denied / env_granted on interp / VM / Go / JS (javascript_root: web_app); difftest hostGrantValue + commandEnv.
• Production -compile-bc unchanged; no linker / CFG / SSA / Wasm / path flip; no new cap kinds; #102–#105/#108 not reopened.
• Docs/journal honest: Phase 2a Done, Phase 2 remaining; other generated host effects still unmediated.

Hard nos

Clean.

Non-blocking

CI build still in progress at review time — EM undraft + squash when green.

EM: clear to undraft + squash-merge when CI green. Do not mark #90 Done.