Larger PR split intentionally into smaller incremental commits for easier review. I recommend first looking at the tests and documentation changes to get a big picture view. Then, walk through the commits one at a time to review in batches.

Long standing todo here that has been put off long enough.

AbortSignal

• An IoContext is not longer required to create. Signals can be created at global
  scope and created/observed/aborted across different requests. new AbortController(),
  AbortSignal.abort(), new WritableStream(), and request.signal no longer throw
  during module evaluation. AbortSignal.timeout() still requires an IoContext to schedule
  the timeout.
• Per-registration native cancellation. The signal-wide IoOwn<RefcountedCanceler> is
  gone. Each wrap() / newCanceler() / addAbortAction() registers a cell bound to the
  registering request's IoContext. Aborts triggered elsewhere are delivered into the owning
  context on its next turn (or silently dropped if it's gone); registrations are reclaimed on
  completion and at IoContext teardown, and swept thereafter, so long-lived signals don't
  accumulate per-request state.
• RefcountedCanceler is now ReleasingCanceler. Single-owner, releases rather
  than cancels wrapped promises on drop, unlinks listeners as it fires them, and fires
  late-registered listeners immediately.
• Spec-shaped internals. addEventListener's {signal} option is an abort algorithm
  (runs before abort listeners); AbortSignal.any() uses the spec's dependent-signals model
  with flattening (fixes the expected-fail WPT ordering test; deletes the followingSignal and
  synthesized-listener hacks); triggerAbort follows the spec's "signal abort" sequence;
  synthetic dispatchEvent('abort') no longer runs internal plumbing; pre-aborted wrap()
  rejects with the reason-derived exception instead of throwing a TypeError.
• onabort follows HTML event-handler semantics: it occupies the listener-list position of
  its activation instead of always firing first.
• RPC. Per-clone registrations with owner routing (a signal may be serialized from several
  requests); the pending abort reason arrives in a mutex-guarded box readable from any
  context; arming the abort subscription is centralized in addAbortAction() and gated to
  abort-relevant registrations (no longer blocks actor hibernation for unrelated listeners).

EventTarget

• NativeHandler machinery deleted (the handler OneOf, 9 hash-callback overloads,
  bidirectional bare-reference lifetimes, custom destructor, and the GC-visitation special
  case). EventHandler is a flat, identity-keyed record; internal consumers use the
  AbortSignal primitives above instead.
• DispatchExceptionPolicy. The JS-exposed dispatchEvent() and abort-event dispatch
  report listener exceptions (via the global scope's error event) and continue, per spec —
  so abort() can no longer throw from a throwing listener. The runtime's top-level event
  delivery (fetch/scheduled/etc.) keeps the propagate behavior.
• Protected hooks (managesEventHandlerAttribute, addEventHandlerListener) for subclasses
  implementing positioned event-handler attributes.

New internal API surface: AbortSignal::wrap() (rejects with the abort reason),
newCanceler(), addAbortAction() (context-bound), addAbortAlgorithm() (JS-heap);
documented in docs/reference/detail/abort-signal.md.

Additional edits

• Default Event's trusted flag to NO — Event's constructor defaulted trusted to
  YES, so user-constructed subclasses (CustomEvent, MessageEvent, ErrorEvent,
  CloseEvent) incorrectly reported isTrusted === true. Untrusted is now the default;
  runtime construction sites (and runtime-only subclass constructors such as
  ExtendableEvent) pass Trusted::YES explicitly.
• Update legacy on<type> handlers to use proper positions — new
  EventTarget::get/setEventHandlerAttribute() implements HTML's event handler IDL
  attribute semantics once (trampoline listener at first-assignment position, kept across
  reassignment, fresh position after clearing, non-callable objects stored but never
  invoked). AbortSignal.onabort migrates onto it (deleting its bespoke copy);
  MessagePort.onmessage and EventSource.on{open,message,error} no longer always fire
  before addEventListener() listeners.
• Smaller EventTarget cleanups — the never-invoked EventListenerCallback machinery
  is replaced with a listenerCountChanged() virtual notified on every listener-set
  mutation. Fixes addEventListener('message') never starting a MessagePort (only
  onmessage assignment did), and makes a closed port terminal (clearing onmessage
  could previously reset it to pending).
• Move internal event dispatches to report policy — WebSocket, EventSource, and
  MessagePort runtime-fired events now dispatch with spec semantics: a throwing listener is
  reported (global error event + console) and the remaining listeners still run.
  The historical fail-fast reaction is preserved on top via
  DispatchResult::firstException: the WebSocket still errors out, the EventSource still
  closes (dropping the rest of the batch), and the MessagePort still dispatches
  messageerror. Also fixes reportError() re-entrancy: a throwing global error
  listener now logs to console (HTML's "in error reporting mode" flag) instead of
  propagating out of the dispatch or recursing.
• Make standard Event subclasses moar standard — MessageEventInit supports the full
  spec surface (data now optional defaulting null, plus origin, lastEventId,
  source, ports, and the EventInit members); CloseEventInit/ErrorEventInit gain
  bubbles/cancelable/composed. Runtime-constructed events are unchanged.
• Update stale comments/docs following the above.

Behavioral changes

• isTrusted is now false for user-constructed Event subclass instances (spec).
• on<type> assignment takes a listener-list position instead of always running first;
  registering any 'message' listener starts a MessagePort.
• A throwing listener no longer skips the remaining listeners for that event, and its
  exception surfaces on the global error event/console in addition to the existing
  per-object failure reaction. A throwing 'message' listener on a MessagePort now
  triggers messageerror (previously a second 'message' event carrying the exception).
• new MessageEvent(type) works without an init; init members are reflected per spec.

Compat flags?

The behavioral changes here should be unlikely to require compatibility flags, but I could be convinced with some good practical examples.