moonpool-hyper: HyperTimer::new panics on wasm32-unknown-unknown (Instant::now in the anchor)

Start in crates/moonpool-hyper/src/rt.rs at HyperTimer::new and compare the wasm32-unknown-unknown path with native Instant::now(). Run the paros wasm demo or another browser/wasm runtime that constructs H2Server or ReconnectingChannel with keepalive. Done means the runtime panic is gone, keepalive continues on provider time, and the same seed produces byte-identical RunResult JSON across browser and native runs.

Downstream evidence

The paros wasm demo (PierreZ/paros, crates/paros-wasm-demo) has been dead in the browser since its gRPC transport moved onto moonpool-hyper. Every runSeed(seed) aborts on load with:

panicked at library/std/src/sys/time/unsupported.rs:13:9:
time not implemented on this platform
...
at <std::time::Instant>::now
at moonpool_hyper::server::H2Server<P>::new

Reproduced on paros main (4d7d68d) with the pinned moonpool rev 980a6acc: any page load of the demo → RuntimeError: unreachable. It went unnoticed because CI only runs cargo check --target wasm32-unknown-unknown, which cannot catch a runtime panic.

Root cause

HyperTimer::new (crates/moonpool-hyper/src/rt.rs) captures its anchor via Instant::now(), which is unimplemented! in std on wasm32-unknown-unknown. The anchor is arbitrary by the timer's own contract — it cancels out of every deadline hyper computes (deadlines are minted from Timer::now() = anchor + provider elapsed, and consumed relative to later Timer::now() reads), so only provider-time differences are ever meaningful. h2 keepalive exercises Timer::now() heavily (hyper/src/proto/h2/ping.rs), so the timer cannot simply be dropped on wasm without diverging sim behavior between native and browser.

Smallest requested behavior

Mint the anchor without touching the wall clock on wasm32-unknown-unknown, keeping native targets on Instant::now() bit-identically. On that target std's Instant is a newtype over Duration (std::sys::time::unsupported), for which Duration::ZERO's bit pattern is a valid value, so a transmute::<Duration, Instant>(Duration::ZERO) behind the target cfg works; transmute enforces the size match at compile time, so a std layout change fails the wasm build loudly.

Branch wasm-safe-hyper-timer (commit debdcf3, based on exactly rev 980a6acc so downstream pins can advance with zero seed drift) implements this; paros temporarily pins it until the fix lands on main.

Deterministic replay constraints

• Native behavior must stay bit-identical (the anchor value never reaches behavior; native keeps Instant::now()).
• Browser and native replays of the same seed must produce byte-identical RunResult JSON — which requires h2 keepalive to keep running on provider time on wasm, i.e. the timer must exist and answer now() there.

Acceptance criteria

• cargo check --target wasm32-unknown-unknown -p moonpool-hyper passes (it already did — a runtime gate is what's missing).
• A browser (or wasm runtime) execution of a sim that constructs H2Server/ReconnectingChannel with keepalive completes without the panic. Downstream: the paros wasm demo runSeed returns a RunResult byte-identical to the native run of the same seed.