feat(truapi-host): dev-gated worker dial to the debugger and core schema-hash reporting

[decrypto21]

Stacked on the standalone PR. Design doc: #315.

Makes the web host dial the debugger, which is what turns the previous PRs into something you can watch.

What

• Dev-gated worker dial — the worker link reads its debugger URL behind a build-time DEV condition the bundler replaces with a literal, so a production bundle returns no URL. This is the production guarantee, and it has to be the bare token: read through an alias (const meta = import.meta) no bundler substitutes it, the expression survives into the bundle, and it evaluates against an object a plain module does not have — refusing in every build, so the guarantee held by accident rather than by the stated mechanism.
• Core schema-hash reporting (coreWireSchemaHash) — the tap runs on the main thread and the core in the worker, so the panel could not read the core's hash across that boundary and could never decode in principle. The worker now reports the hash it already computes. New public surface, flagged rather than left to be found.
• Says why it did or did not dial — silence was indistinguishable from success: the debugger's own viewer holds a socket, so an empty board with a live socket read as a broken debugger rather than a host nobody enabled.

Verification

tsc -b clean, 90 tests, DEV gate verified in both directions from built output (try{e=!0} dev, try{e=!1} prod).