Expose WebGL2-backed GLES bridge capabilities

[brandonpayton]

Purpose

Native GLES clients should see a coherent ES2-style capability surface when Kandelo forwards GL commands to a browser WebGL2 context. The bridge already used WebGL2 as the backing implementation, but capability reporting and a GLES extension token path were incomplete: native callers could observe raw browser extension names, miss WebGL2-backed GLES2 feature gates, or pass the GLES half-float token where WebGL2 expects its core token.

This change makes the browser-backed GLES contract explicit and shared: report only GLES-facing capability names for features the WebGL2 backend implements, enable optional WebGL capabilities before advertising their GLES equivalents, and translate the known half-float token mismatch at the bridge boundary.

Changes

• Add a shared WebGL2-to-GLES capability helper for core and optional extension reporting.
• Use the helper in both WebGL2 context creation paths instead of duplicated extension-enablement code.
• Return Kandelo GLES identity/version/extension strings from the synchronous GL query path.
• Normalize GL_HALF_FLOAT_OES to WebGL2 GL_HALF_FLOAT for texture uploads and readbacks.
• Document the browser KMS/EGL/GLES bridge capability contract.
• Add host WebGL bridge coverage for extension reporting and half-float upload normalization.

Contract Notes

• Browser WebGL-backed GLES behavior changes for hosts that provide a WebGL2 canvas.
• Node-visible POSIX behavior is unchanged; the changed path depends on a browser WebGL2 rendering context.
• ABI is unchanged.
• No package artifacts, VFS images, or binary indexes are changed.

Validation

Check	Result
git diff --cached --check	passed
bash scripts/dev-shell.sh bash -lc 'cd host && npm ci'	passed in the fresh worktree
bash scripts/dev-shell.sh bash scripts/build-musl.sh	passed; needed to provide the sysroot for host test global setup in the fresh worktree
bash scripts/dev-shell.sh bash -lc 'cd host && npx vitest run test/webgl-bridge.test.ts test/webgl-shadow.test.ts test/webgl-main-forward.test.ts'	passed: 3 files, 45 tests

Not Run

• Full repository build.
• Full host Vitest suite.
• Browser Playwright suite.
• POSIX/libc/Sortix conformance suites.