Separate header-only host APIs from exported native symbols #631

Follow-up to #625/#626.

Problem

CI run 35430597424 proves the first recovery classified four current typed drag/download APIs correctly for the legacy-symbol scan but also subjected them to the contract's exported-symbol requirement. They are deliberately header-only host calls in the current packaging surface, so Linux and macOS fail looking for _webscene_engine_dispatch_drag_v1 and peers in the export list.

Fix

Separate independently versioned native host APIs into exported and header-only sets. Require header-only drag/download APIs in the public header, require exported host APIs in both header and export list, and use the union only when excluding valid services from the fail-closed legacy-JavaScript-interop scan.

Acceptance

• The four typed drag/download calls must exist in the header and need not appear in the export manifest.
• Existing exported host services remain required in both sources.
• Unreviewed v1/v2 engine/interop symbols remain rejected.
• Current Linux/macOS tooling jobs pass this contract.