Register setTimeout/setInterval/clearTimeout/clearInterval directly on
every global (workers included), keeping the __ns__-prefixed variants
for backwards compatibility. The test app's Handler-based setTimeout
polyfill is retired: the suite now runs on the native timers.

Register requestAnimationFrame/cancelAnimationFrame on every global
(workers included), built on the existing frame-callback machinery with
spec semantics: one one-shot entry per request, a returned handle,
cancellation by handle, and a single performance-timeline timestamp
argument. The __postFrameCallback/__removeFrameCallback pair stays as
the backwards-compatible surface.

…37.0)

Starting with the API 36.1 scheme, the SDK can ship platforms only in
minor-versioned directories (e.g. android-37.0) with no plain android-37
alias, so paths built as "platforms/" + android.compileSdkVersion break
the SBG classpath and the typings include filter with a
FileNotFoundException on android.jar.

Resolve the real platform directory against disk instead: exact match
first, else the highest android-N.M for the API level (extension dirs
like android-33-ext4 are not base platforms), with a clear error when
no platform is installed. Resolution happens at execution time so a
missing platform fails the SBG/typings task rather than configuration.

…#2026)

Definitions can now be annotated with the API level each class and member
arrived in and, where it did not survive, the level that deprecated or removed
it, by passing --api-versions and --min-sdk. This matters most alongside
--merge-class-versions, where members only older platforms have are generated
from those jars and otherwise read as though they were still there.

Nothing here passes the new options yet, so the definitions this repo generates
are unchanged apart from duplicate declarations the generator no longer writes
twice.

Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.6.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@03ad4de...dd06d9c)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[skip ci]

Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.37.3 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@e4fba86...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[skip ci]

…2030)

Bumps [mikepenz/action-junit-report](https://github.com/mikepenz/action-junit-report) from 6.4.2 to 6.5.0.
- [Release notes](https://github.com/mikepenz/action-junit-report/releases)
- [Commits](mikepenz/action-junit-report@d9f48fc...a9170d5)

---
updated-dependencies:
- dependency-name: mikepenz/action-junit-report
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[skip ci]

Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.3 to 2.4.4.
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@4eaacf0...2d11466)

---
updated-dependencies:
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[skip ci]

…2032)

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.19.4 to 2.21.0.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@9af89fc...05e3151)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[skip ci]

… modules (#2038)

ResolveSpecifierToPath dropped `?query#fragment` from every non-http
  specifier before consulting the import map or the referrer. A module
  served over HTTP that imports `/ns/asm?path=%2Fsrc%2FHome.vue` therefore
  resolved to `http://host/ns/asm`, which the Vite dev server answers with
  400 because the query is the module's identity. Any root-relative or
  relative `/ns/...` specifier carrying a query hit the same wall
  (`?path=`, `&mode=inline`, `?vue&type=`, `?ns_worker=1`), so every
  framework on the Vite dev flow was exposed; Vue merely hit it first.

  The seam now strips the query only once every HTTP outcome has
  returned, which is the iOS runtime's ordering: import-map lookup and
  HTTP-referrer resolution see the full specifier, and only filesystem
  probing sees the bare path. import() hands its specifier to the seam
  verbatim and routes on the resolved URL when the seam makes a relative
  or root-absolute spec HTTP, so those imports stay on the async graph
  walk instead of the blocking fallback.

…dPriority (#2041)

* feat: accept platform options under android, deprecate androidPriority

Worker options now carry Android-specific settings in an `android` namespace
object, so future platform options have a place to live instead of
accumulating as `androidSomething` keys on the top level:

    new Worker("./w.js", { android: { priority: "lowest" } })

`android.priority` is validated strictly — a non-object `android`, or a
priority that is neither one of the camelCase THREAD_PRIORITY_* names nor a
nice value, throws a TypeError — while unknown keys inside `android` are
ignored so later options can be added without breaking older runtimes.

`androidPriority` keeps its current behavior and logs a one-time per-process
deprecation warning; `android.priority` takes precedence when both are given.

An option getter that throws now stops construction rather than being
swallowed into the default priority, and an option error reaches JS as a real
TypeError instance so `e instanceof TypeError` holds.

* fix: clamp numeric worker priorities before converting to int

* feat: resourceLimits for worker isolates

Adds Node's `resourceLimits` worker option, at the top level of the options
object rather than under `android`:

    new Worker("./w.js", {
      resourceLimits: {
        maxOldGenerationSizeMb: 64,
        maxYoungGenerationSizeMb: 8,
        jsDispatchTableSizeMb: 64,
      },
    });

The two heap caps map onto v8::ResourceConstraints and are applied through a new
`IsolateLimits` struct. A worker's isolate is created on the worker thread deep
inside the Java initWorkerRuntime call, a path with no parameter to carry them,
so WorkerWrapper leaves them -- together with the near-heap-limit callback -- in
a thread-local slot that PrepareV8Runtime consumes; the main isolate never sets
one and is unaffected. Values are validated at construction: a non-object
`resourceLimits` or a non-numeric key throws a TypeError, a non-finite or
non-positive value throws a RangeError, and unknown keys are ignored.

`jsDispatchTableSizeMb` is a NativeScript extension compiled behind
V8_HAS_JS_DISPATCH_TABLE_RESERVATION_PARAM, which v8-14.9.207.39-7 carries.
Worker isolates default to a 64 MB reservation instead of V8's 256 MB, and the
main isolate keeps the default; against an older prebuilt the option is rejected
as unsupported.

Capping a worker's heap is only useful if exhausting it is recoverable, so every
worker isolate now registers a near-heap-limit callback (Node does the same
unconditionally for workers). It forwards "Worker JS heap out of memory" to the
parent's worker.onerror as a plain string payload, asks V8 to terminate the
isolate and returns the limit raised by 16 MB so the in-progress GC can finish.
Termination goes to the isolate the callback belongs to rather than through
Terminate() alone, because Terminate() only reaches an isolate BackgroundLooper
has already published -- which happens once the worker's runtime is up, and a
worker that exhausts its heap can do so while its entry is still loading.

Building the exception detail for a terminating isolate could crash on the empty
v8::Message such an isolate reports, so GetFullMessage now returns the plain JS
message when there is none.

* fix: cap resourceLimits to the platform's size_t range