runtime: add dharma-required functions to el_runtime.c and runtime/*.el

Add the following functions that dharma registry calls but were missing
from the El runtime:

el_runtime.c (consumed by the old build system via released SDK):
  - list_len, list_get — aliases for el_list_len/el_list_get (handlers.el)
  - json_array_push — append pre-encoded element to JSON array string
  - now_millis, unix_timestamp_ms, time_now_ms — ms-since-epoch aliases
  - log_info, log_warn — structured stderr log helpers
  - config — reads config from environment (alias for getenv)
  - http_patch — HTTP PATCH with Content-Type: application/json
  - http_post_engram — HTTP POST with optional X-API-Key header
  - http_get_engram — HTTP GET with optional X-API-Key header
  - str_to_bytes — encode string as JSON byte array [72,101,...]
  - bytes_to_str — decode JSON byte array back to string
  - hash_sha256 — SHA-256 hex digest using built-in sha256 impl

runtime/*.el (consumed by the new build system):
  - http.el: http_patch, http_post_engram, http_get_engram
  - time.el: now_millis, unix_timestamp_ms, time_now_ms
  - env.el: config, log_info, log_warn, list_len, list_get
  - json.el: json_array_push, bytes_to_str
  - string.el: str_to_bytes, hash_sha256 (via __sha256_hex seed)

el_seed.h / el_seed.c:
  - __sha256_hex primitive with self-contained SHA-256 implementation

runtime/http.el

@@ -170,6 +170,35 @@ fn http_response(status: Int, headers_json: String, body: String) -> String {
     return __http_response(status, headers_json, body)
 }
 
+// ── HTTP client — PATCH ───────────────────────────────────────────────────────
+
+// http_patch performs an HTTP PATCH request with Content-Type: application/json.
+fn http_patch(url: String, body: String) -> String {
+    return __http_do("PATCH", url, body, "{\"Content-Type\":\"application/json\"}", el_http_timeout_ms())
+}
+
+// ── HTTP client — Engram variants (optional API key) ──────────────────────────
+//
+// These are used by dharma's db.el to talk to Engram nodes.
+// The key parameter is the X-API-Key header value; pass "" for no auth.
+
+// http_post_engram performs an HTTP POST with Content-Type: application/json
+// and an optional X-API-Key header. If key is "" no auth header is added.
+fn http_post_engram(url: String, key: String, body: String) -> String {
+    if str_eq(key, "") {
+        return __http_do("POST", url, body, "{\"Content-Type\":\"application/json\"}", el_http_timeout_ms())
+    }
+    return __http_do("POST", url, body, "{\"Content-Type\":\"application/json\",\"X-API-Key\":\"" + key + "\"}", el_http_timeout_ms())
+}
+
+// http_get_engram performs an HTTP GET with an optional X-API-Key header.
+fn http_get_engram(url: String, key: String) -> String {
+    if str_eq(key, "") {
+        return __http_do("GET", url, "", "{}", el_http_timeout_ms())
+    }
+    return __http_do("GET", url, "", "{\"X-API-Key\":\"" + key + "\"}", el_http_timeout_ms())
+}
+
 // ── SSE — Server-Sent Events streaming ───────────────────────────────────────
 //
 // Usage pattern for an SSE handler: