* Update snarkVM to v4.9.0 and bump package versions to 0.11.6

Moves all ten snarkvm-* dependencies from the git rev pin
b7f0859 (v4.8.1) to version = "4.9.0" on crates.io, since every
snarkvm-* crate is published at that version. No git source remains.

The only source change the upgrade required is a consensus-version count.
snarkVM's ConsensusVersion enum went from V1..V17 to V1..V18, and
NUM_CONSENSUS_VERSIONS is the cardinality of that enum, so
get_or_init_consensus_version_heights now requires eighteen heights
rather than seventeen. Passing the old count panics, which crosses the
wasm boundary as an opaque RuntimeError: unreachable. Three places
encoded seventeen:

- sdk/tests/wasm.test.ts now derives the list from a named constant, so
  the next consensus version is a one-number change.
- The getOrInitConsensusVersionTestHeights doc example was a
  seventeen-value CSV, which no longer runs as written.
- test_set_genesis_block_non_zero_fails passed thirteen heights and
  relied on #[should_panic]. It was passing on the length-mismatch panic
  rather than the genesis check it names, so it would have stayed green
  had that check been removed. It now passes eighteen ascending heights
  starting at ten, leaving a non-zero genesis as the only rule broken.

Lockfile churn beyond snarkvm-* is confined to one chain reached from
snarkvm-console-algorithms: k256, elliptic-curve, ecdsa and crypto-bigint
graduate from release candidates to finals, which restores the RustCrypto
crates to their unprefixed ff and group names and splits out primefield,
primeorder and wnaf.

yarn.lock is updated alongside the version bump. CI installs with
--immutable, so leaving it stale fails every job.

* Apply the consensus-count changes missed on the first pass

The testnet branch had already made this upgrade as testnet-v4.9.0, and
comparing against it found four files this branch had not updated. Three
were further copies of the seventeen-value consensus CSV that a repo-wide
grep would have caught, and one was a real API change:

- wasm/src/programs/manager/execute.rs now calls snarkVM's
  varuna_version_from_consensus instead of matching on the consensus
  version by hand. The two are equivalent today, both mapping V1..=V3 to
  VarunaVersion::V1 and everything above to V2, so cargo check had no
  reason to complain. The duplicate is still worth deleting: upstream
  notes that adding a VarunaVersion::V3 means updating that function, and
  a hand-rolled copy would silently keep returning V2.
- create-leo-app/template-devnode-js/index.js is runnable template code,
  so anyone starting from it against a devnode would have hit the panic.
- sdk/src/program-manager.ts and the generated api_reference mirror carry
  the same CSV in JSDoc examples.

sdk/tests/wasm.test.ts is realigned to testnet's exact text. This branch
had rewritten it to derive the list from a named constant, which reads
better but would conflict the next time mainnet and testnet are synced.

Also restores "type": "module" to wasm/package.json. wasm/test.js
strips it for the duration of wasm-pack test and puts it back in a
finally block, and the previous commit was made while that test run was
in flight, so it captured the stripped state. The package is ESM-only and
would not build or resolve for consumers without it.