[callumalpass]

Ports runtime source fdb123eac28962acb99bf639d52bc62652dfbf77 (#959) into the runtime/ snapshot (last bulk export #864); no full re-import or hosted/migration route changes.

• Credentialless * CORS with the same fixed method/header/expose lists; ignore LOGSVC_CORS_ORIGINS and remove Origin-based WebSocket rejection.
• Port upstream regression/conformance cases; add Android localhost, Obsidian, multiple loopback ports, malformed retained config and poisoned legacy-var getter coverage. Token, nonce, PoP and replay checks remain unchanged.
• Update docs/changelog. No deployments or environment changes. Ops config cleanup is separate and must preserve existing release equality/receipt guards until explicitly retired.

Validation: remote wasm release build + worker-build packaging; local isolated workerd CORS regression passed. Remote lint/unit and complete local conformance results will follow.

PR only: do not merge or auto-merge; coordinator owns rollout after the production bulk-migration window.

[callumalpass]

Validation complete at a98129d: rustfmt (runtime workspace + DO); rcargo wasm release build and worker-build packaging (cargo delegated remotely); rcargo DO CORS unit test (1 pass), DO wasm clippy and log-conformance all-target clippy with -D warnings. Full isolated local npm test passed: proxy tests, native-denial suites, 20 wire cases + 4 browser-push cases in each of four runtime/restore profiles, CORS/nonce/auth/replay and restart coverage. No live environment access or deployments.

The runtime/.github/workflows/logsvc-do.yml file is an imported source file, not an active Connect workflow. This PR does not move the Worker producer or alter existing CI gates; the Worker regression was executed locally against a fresh remotely built bundle.

[callumalpass]

CI green at a98129d: Server CI 40786151175 (including Qualification/node) and Desktop release smoke 40786151169 passed; nonselected lanes skipped by existing classification. Full local Worker tests also passed as recorded above. Stopping here: no merge, auto-merge, deployment or environment changes.