[ymote]

Socket-based Rust components can compile for wasm32-wasip2, but the SDK previously refused their imports and reported every socket-oriented crate as incompatible. This change accepts ordinary WASI TCP, UDP and DNS, adds their host compatibility requirement automatically, and teaches the publisher regression checks to distinguish a compatible socket app from one that would fail on RC5.

Depends on App Hub #209. The publisher toolchain is pinned to its exact reviewed head c317f787ea2f620543000561c2470106644c1fc7. Do not merge before that dependency and the host runtime are reviewed. Released RC5 still cannot run socket components.

• octo wasm build adds existing host-api-v1 plus host_api.required: {"wasm.sockets": 1} whenever any wasi:sockets interface is imported, including DNS. Other requirements are preserved; conflicting ABI versions fail before bundle writes. There is no new requires feature that would break older catalog readers, and net remains a disclosure.
• wasm info explains compatibility; wasm doctor warns about backend/feature portability instead of refusing network crate names. Native TLS/library limitations remain explicit.
• Refuses an exported function named connect before linking: the bare WIT export shadows wasi-libc’s socket symbol and was reproduced as an out-of-bounds trap. The compile-fail regression recommends tcp_connect; private helpers remain allowed.
• Adds a real std::net component example for bounded TCP/UDP echo and DNS; no SDK socket wrapper. Tests found that Rust's WASI UDP backend does not implement set_read_timeout, so UDP uses a tested nonblocking clock deadline and short sleeps.
• Updates matching English/Chinese Rust and publishing guides, SDK readmes, template guidance and AGENTS.

Validation on macOS:

• Rust workspace: 20 tests and 7 doctests passed; 3 pre-existing ignored documentation snippets.
• Python tools: 48 tests verified (one initially skipped contract-parity check was rerun against the pinned Hub and passed).
• Exact pinned publisher: 14/14 checks, including socket admission with the required ABI, missing ABI refusal, shared-component preparation, preservation through publisher-prepare, and missing-proof/malformed-component refusal.
• Actual octo wasm build → wasm info → octo check: 171,358-byte socket component, three typed exports, required API added, gate — PASSED.
• Formatting, diff checks and relative Markdown links passed.

This validates SDK transport in Wasmtime 49 and structural publisher preparation. It does not publish an app or establish phone, public-network DNS, production socket quota/cancellation, or released-shell acceptance. Those remain host validation responsibilities.