feat: module configuration, scoped callers and moduleConfigs

[dlipicar]

Part of the method-scoped grants and per-module configuration layer (feat/method-scopes). Stacked on #171 (feat/runtime-process); the diff shows only this layer. Relocked onto logos-protocol#101.

What changes

Module configuration: LogosModuleContext::configuration()

• The generated glue exports logos_module_set_configuration(const char*).
  • The export is optional and looked up by name, like logos_module_set_runtime_delegate, so the module-impl-abi check is unaffected.
  • It is guarded MAJOR-aware on protocol 0.13, so unifdef can resolve it.
• The export:
  • stores the host's document under the context lock;
  • refuses JSON it cannot parse;
  • refuses once the context has fired;
  • calls no lp_*.
• The one-shot latch hands the document to the impl (_logos_codegen_::maybeSetConfiguration) before maybeSetContext. So onContextReady() already sees configuration().
• The latch now checks and fires under that lock, so a race can't fire it twice.
• The configuration never carries authority. What a caller may call comes from the access policy.

LogosCaller::scoped

• True only when the caller document carries "scoped":true. The target's runtime writes that when the call passed a method-list grant for exactly this method (logos-protocol#101).
• It is read only from a boolean true, on any arm that parses. A failed arm resets it with everything else.

not_authorised

• The refusal code keeps its value through LpClient's error channel to the generated wrappers. A new test pins it.

LogosCore

• Config::moduleConfigs maps each module name to one JSON document.
  • For a separate runtime it is sent as the module_config spawn key.
  • In-process it goes through logos_core_set_module_config.
• logos_core_set_access_policy now returns int, and a refused policy throws like every other protected input. It is refused when malformed or when its mode is unknown.

Verification

• macOS: checks.tests (399/399), checks.module-impl-abi and checks.generator-cli all pass.
• CI runs on this PR.
• Configuration arriving before onContextReady() is tested end to end downstream:
  • logos-module-loader-qt's native host fixture;
  • the test-modules probe module, driven by the logoscore-cli and logoscore-py suites.

🤖 Generated with Claude Code

[github-actions]

📊 cpp-sdk doc-test report

The real accounts module, run through a logoscore daemon with the whole stack built against this commit of the C++ SDK — rendered alongside the commands actually run and their output (updated each run, commit a856b19):

• ubuntu-latest report
• macos-latest report

Pages can take a minute to update after the run finishes.