[dnnsjsk]

Adds experimental Express 5.3.0 and Hono 4.13.13 support through an opt-in Node runtime (Engine::enableNode() / phasis --node). CommonJS loading and Node host APIs are implemented in PHP; JavaScript executes in Phasis, including JavaScript children launched through process.execPath. The runtime covers buffers, streams, filesystem and process I/O, networking, TLS, compression, timers, async context and isolated VM realms. Includes the v0.9.0 changelog and runtime version metadata.

Pinned upstream runners preserve original assertions, complete case inventories, upstream skips, source identities and bounded worker cleanup. Express/Hono runs explicitly use --timeout-scale 10, recording original and effective test/hook deadlines. The default remains 1; application clocks, test262 deadlines and engine execution budgets are unchanged. Independent native Hono Vitest baselines retain their original limits. Support remains experimental while framework performance work is deferred.

Validation of the release source b4624b7, with report-only commit a60d51b:

• Canonical test262 matrix: all 53,616 discovered files pass across all 161 groups, with zero failures, skips or incomplete coverage. Suite pin: d53ebc8b1931d9f1541e43d59650776e4b766248.
• Full local verify-all: 2,410 tests, 6,695 assertions, two existing skips, all 16 oracle scenarios, PHPStan and coding standards pass. Existing asynchronous diagnostics match the previous successful run.
• PHP 8.5 tracing-JIT benchmarks retain all 16 expected results.
• Fixed test262 ABBA comparison: all 874 files and 1,711 original variants pass in all four runs. Median inclusive time improves from 60.865s to 53.018s (12.89%), with all sampled category totals improved. Individual slower cases remain recorded, including two revoked-proxy cases taking roughly 26ms longer. This is a targeted sample, not a full-suite performance guarantee; only opt-in Node version metadata changed afterward.
• The Composer archive includes every runtime file and all 57 Node assets. Installed normal CLI, Node CLI and PHP-backed child-process smokes pass, including version 0.9.0.
• Local Express: all 1,261 cases pass in Phasis and in an isolated native Node 26.12.0 container, with exact ordered cases, source identities and original/effective deadlines. Initial host-native failures included a Cloudflare response to a loopback request; that evidence is retained. The isolated control used no external network.
• Local HTTP/2 interoperability passes all four server/client and TLS combinations, with three streams each. Owned workers, the temporary container and downloaded Node image are removed.

Complete local Hono validation passes: main has 4,158 passes and 37 upstream skips across all 122 files; alternate JSX DOM has 505 passes and three upstream skips; the Node adapter passes all 14 cases. Generated Node controls and independent native Vitest baselines also pass, including all five declaration/toolchain cases. Ordered case identities, assertion counts and original/effective deadlines match. A byte-for-byte comparison of all 357 normalized generated files and dependency resolutions proves that the default JSX profile's nine files and 508 cases are covered by the main run. No local Hono retries were needed. All owned test workers and listeners are reaped.

Framework CI reports complete passing Phasis cases. Its remaining failure is the generated Node control's timing-sensitive concurrent interval test. The complete local Phasis checks and local native controls pass. The merge relies on those results, as requested; framework CI is not rerun. v0.9.0 is published. Release and release-format workflows pass; the downloaded archive matches all 527 runtime files and 57 Node assets, and installed CLI, Node-mode and file-based child-process checks pass. Local main and the release tag point to merge commit 1408569, whose tree is identical to tested PR head a60d51b.