kj-rs-tokio: a kj::EventPort driven by a per-thread tokio runtime

[danlapid]

Groundwork for the tokio-backed Rust I/O backend (kj-rs-tokio / kj-rs-io,
landing separately); kj-rs itself stays a pure Promise<->Future bridge.

• Replace KjWaker with FutureWakerCell: every cloned waker is a same-thread
  cell (non-atomic kj::Refcounted; the bridge's single-thread axiom) that
  arms the owning FuturePollEvent directly via Event::armDepthFirst(). The
  cell's link to the event is weak and structurally invalidated when the
  event dies, so wakers Rust retains past the future's lifetime (e.g.
  parked in a channel's AtomicWaker) neutralize into safe no-ops instead of
  arming a freed event. Waker ownership round-trips through RawWaker data
  slots via kj::Rc::disown()/reown() -- hence the capnp-cpp pin bump to the
  current v2 head, which carries those (merged upstream).
• Replace the LinkedGroup machinery (linked-group.h + test) with an
  intrusive weak link (RustPromiseAwaiter::link / FuturePollEvent::leaves).
• Make bridged kj::Promises eager by default: the Rust future is polled
  to its first suspension point at conversion, so KJ callers no longer need
  a manual .eagerlyEvaluate(nullptr); RustFuture::lazily() is the escape
  hatch for the rare cold case.
• Convert panics escaping a bridged future's poll into kj::Exceptions (a
  rejected promise) instead of aborting the process, mirroring the sync
  bridge's catch_unwind path.
• Add a thread-local armed-waker hook so an integrating kj::EventPort that
  drives tokio tasks inside its own wait() (the upcoming kj-rs-tokio) can
  nudge itself out of a blocking park; null/no-op by default.
• Split the cxx bridge module out of lib.rs into ffi.rs, and quarantine
  unsafe into named FFI islands: deny(unsafe_code) crate-wide, re-allowed
  per-module only where the FFI seam genuinely needs it.
• Depend on @capnp-cpp//src/kj:kj-async-core instead of the :kj-async
  umbrella, keeping kj-rs (and everything built on it) off the concrete kj
  OS event loop.
• New tests: waker neutralization across event death (neutralize-waker-test),
  FuturePollEvent shared-event semantics (shared-event-test), and expanded
  future/awaiter coverage.

[ask-bonk]

APIError: Invalid Anthropic API Key

github run

[ask-bonk]

APIError: Invalid Anthropic API Key

github run

[ask-bonk]

APIError: Invalid Anthropic API Key

github run

[ask-bonk]

@danlapid Bonk workflow failed. Check the logs for details.

View workflow run · To retry, trigger Bonk again.

[codspeed-hq]

Merging this PR will degrade performance by 8.18%

❌ 1 regressed benchmark
✅ 71 untouched benchmarks
⏩ 129 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	simpleStringBody[Response]	22.7 µs	24.7 µs	-8.18%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing dlapid/rustIoPart1 (ff4d77b) with dlapid/rustIoPrep (dbc8012)²}

Footnotes

1. 129 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on dlapid/rustIoPrep (731a392) during the generation of this report, so 7a1a474 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩