Prove the browser claim with a Pyodide/WASM CI job

[EONRaider]

Target: 2.2.0 (Tier 4 — proof as the product)

Running in a browser is the one capability scapy structurally cannot
match, and we currently neither test nor claim it.

The measurement

Blocking exactly the modules Pyodide removes from the stdlib
(fcntl, termios, resource, grp, pwd) and re-importing:

OK    netprotocols
OK    dpkt
OK    pypacker
FAIL  scapy.layers.l2 : ModuleNotFoundError: No module named 'fcntl'
FAIL  scapy.all       : ModuleNotFoundError: No module named 'fcntl'

Scapy's from fcntl import ioctl is unconditional in
scapy/arch/linux/__init__.py:11 and scapy/arch/unix.py:13, and
scapy.arch sits on the import path of every scapy import. Scapy
cannot be imported under Pyodide — not "cannot sniff". It is also
absent from Pyodide's built package set.

Our own surface is 11 stdlib modules, with socket used for exactly
four inet_pton/inet_ntop calls and no socket ever created.

Honest caveat, and why the job still matters

dpkt passes the same test. Pure-Python-zero-dependency is not a
unique property — we share it with the fastest incumbent. So this job
does not prove a differentiator on its own; it proves the first half
of "pure and typed and validating", and turns an assertion into a
tested guarantee. Frame the claim accordingly (see #101).

What to do

A CI job that installs the built wheel under Pyodide (or, more cheaply,
a job that blocks the removed stdlib modules and runs the suite) and
decodes the corpus. The cheap version catches ~all of the risk;
a real Pyodide run also validates the wheel.

Acceptance criteria

• CI fails if an import of an unavailable stdlib module is
  introduced.
• The corpus decodes correctly in the constrained environment.
• The README claim, once made, points at this job.