refactor: delete the managed application runner

`proton_app_run` existed because AppKit insists on owning the macOS main
thread. It took that thread, ran the platform UI loop plus CEF's native
message loop there, and pushed the MoonBit application onto a worker
pthread -- which meant every engine call had to marshal back, and the
engine grew a second identity: a "managed" mode with its own runtime
destroy protocol, its own shutdown handshake, and its own set of APIs
that returned PROTON_ERR_UNSUPPORTED because the runner owned the loop.

The host loop makes all of that unnecessary. MoonBit's async main now
runs on the main thread and `proton_host_loop_poll` advances AppKit and
CEF from inside it, so nothing has to cross a thread boundary and every
runtime API works in one mode only. Nothing has called `proton_app_run`
since the facade stopped using it.

What goes with it on macOS:

  - the PROTON_ENGINE_{RETURN,RETURN_U64,RUN}_ON_MAIN macros and their 44
    call sites, plus dialog.m's own copy and notification.m's three
    hand-written equivalents. proton.c's owner-thread check on every
    handle is now the only guard, which is what it was always for.
  - the managed destroy path: begin/finish_managed_runtime_destroy,
    complete_managed_shutdown_if_ready, and the condition variable the
    worker thread blocked on. runtime_destroy is a plain function again.
  - proton_engine_{prepare,run_app_loop,quit_app_loop,finish}_app, which
    only the runner called, and g_proton_app_terminating, which only
    finish_app cleared and nothing ever read.
  - `external_message_pump`, previously off under the runner, is now
    unconditional -- there is no other way to drive CEF.

The `managed_app_runner` feature string and `@native.run_app` go too.
proton_smoke's app-entry test and the runtime-info assertion in
native_wbtest now assert the removal instead of the behaviour, matching
how proton_exports_smoke already tracks retired exports.

The Linux and Windows engines still reference the runner; their sweep
follows. Neither can be compiled here, so it is kept separate.

Author: Milky2018

native/CMakeLists.txt

@@ -11,20 +11,17 @@ endif()
 option(PROTON_WITH_ENGINE "Build Proton with the native browser engine linked" OFF)
 set(PROTON_ENGINE_ROOT "" CACHE PATH "Native browser engine runtime/SDK root")
 set(PROTON_ENGINE_SOURCES src/engine/proton_engine_none.c)
-set(PROTON_APP_RUNNER_SOURCE src/app_runner_stub.c)
 set(PROTON_NOTIFICATION_SOURCE src/engine/notification_stub.c)
 set(PROTON_PLATFORM_EVENT_SOURCES src/engine/platform_events_stub.c)
 
 if(PROTON_WITH_ENGINE)
   if(WIN32)
-    set(PROTON_APP_RUNNER_SOURCE src/app_runner_win.c)
     set(PROTON_ENGINE_SOURCES
       src/engine/cef_win/proton_engine_cef_win.c
       src/engine/cef_win/proton_win_titlebar.c
     )
   elseif(APPLE)
     enable_language(OBJC CXX OBJCXX)
-    set(PROTON_APP_RUNNER_SOURCE src/app_runner.m)
     set(PROTON_NOTIFICATION_SOURCE src/engine/cef_mac/notification.m)
     set(PROTON_PLATFORM_EVENT_SOURCES
       src/engine/cef_mac/launch_input.m
@@ -36,7 +33,6 @@ if(PROTON_WITH_ENGINE)
       src/engine/cef_mac/menu.m
     )
   elseif(UNIX)
-    set(PROTON_APP_RUNNER_SOURCE src/app_runner_linux.c)
     set(PROTON_ENGINE_SOURCES
       src/engine/cef_linux/proton_engine_cef_linux.c
       src/engine/cef_linux/proton_linux_titlebar.c
@@ -67,7 +63,6 @@ add_library(proton SHARED
   src/proton_state.c
   src/proton_update.c
   src/proton.c
-  ${PROTON_APP_RUNNER_SOURCE}
   ${PROTON_NOTIFICATION_SOURCE}
   ${PROTON_PLATFORM_EVENT_SOURCES}
   src/engine/cef_common/bridge_lifecycle.c

native/README.md

@@ -45,20 +45,13 @@ caller still drains `proton_runtime_poll_*` until the queues are empty. Engine
 builds on Windows, macOS, and Linux expose the `runtime_wait` feature. ABI-only
 builds return `PROTON_ERR_UNSUPPORTED`.
 
-On macOS, Windows, and Linux, `proton_app_run` owns the calling UI thread and
-runs the platform UI loop plus CEF's native message loop there. It creates one
-application thread for the MoonBit async scheduler and joins that thread only
-after the application entry has returned. Public runtime and window handles
-are created and owned by the application thread; native engine operations
-marshal to the UI thread. Native callbacks never enter MoonBit. They enqueue
-work and signal the facade's wakeup source so the MoonBit scheduler can resume
-the waiting task. macOS and Linux use a non-blocking pipe descriptor supplied
-by MoonBit. Windows exposes a platform-owned named pipe that MoonBit opens
-before activating it. Linux dispatches UI work through the GLib main context
-owned by the runner. Under this managed runner, `proton_runtime_run`,
-`proton_runtime_quit`, `proton_runtime_do_message_loop_work`,
-`proton_runtime_wait`, and `proton_runtime_next_wakeup_delay_ms` return
-`PROTON_ERR_UNSUPPORTED`.
+The host owns the main thread on every platform. `proton_host_loop_begin`,
+`proton_host_loop_poll`, and `proton_host_loop_end` hand it an event loop that
+outlives any individual runtime, and `poll` is what advances the platform
+toolkit and CEF's external message pump. Runtime and window handles therefore
+belong to the main thread, and there is no marshalling layer between the host
+and the engine. Native callbacks never enter MoonBit: they enqueue work and
+signal the host loop so the MoonBit scheduler can resume the waiting task.
 
 It also exposes `proton_runtime_probe_json`, which validates the configured
 runtime layout before initialization. The probe checks `runtime_root`,

native/include/proton_native.h

@@ -48,7 +48,6 @@ typedef int64_t proton_window_id_t;
 typedef int64_t proton_view_id_t;
 typedef int64_t proton_app_instance_id_t;
 typedef int64_t proton_update_stage_id_t;
-typedef void (*proton_app_entry_t)(void);
 
 enum {
   PROTON_OK = 0,
@@ -91,8 +90,6 @@ PROTON_API int32_t proton_app_instance_attach_runtime(
 PROTON_API int32_t
 proton_app_instance_destroy(proton_app_instance_id_t instance);
 
-PROTON_API int32_t proton_app_run(proton_app_entry_t entry);
-
 PROTON_API int32_t proton_execute_process(const char *config_json,
                                           int32_t *out_exit_code);