Port st static middleware and child fixture corpus

Bun compatibility slice

Port js/third_party/st/st.test.ts at exhaustive corpus position 4062.

Required behavior

• expose the default st(root) static-file middleware;
• serve files through Home's virtual filesystem and Node response surface;
• constrain decoded request paths to the configured root;
• retain causal, operation-tagged static-serving errors without exposing rejected private request paths;
• bridge the spawned Bun fixture through Home's established child-fixture layer, validating the expected st/server/fetch program shape;
• add focused and permanent success/error regression coverage.

Tracked from #66.

Implemented and pushed in 85711f3fa.

Coverage now includes:

• default st(root) middleware over Home's virtual filesystem and Node response contract;
• index selection, content-type selection, 404/next behavior, and successful file bodies;
• raw-path validation before URL normalization, blocking percent-encoded parent traversal;
• StaticFileError with code, operation, phase, configured root, original cause, and causal stack while excluding the rejected request path;
• a targeted child-fixture bridge that validates the expected st/server/fetch flow and mirrors the served fixture content;
• permanent success and traversal/redaction regressions.

Verification:

• focused position 4062: 1 file, 1 passed, 0 failed/todo/unsupported/allowed-empty;
• positions 4061–4062: 2 files, 2 passed, 0 failed/todo/unsupported/allowed-empty;
• permanent gRPC error-stack, SQL adapter-contract, third-party corpus, and 40-case behavior/error diagnostic suites all pass.