v0.4.1 — WIT interface + guest bindings

What's new

• wit/podpedia.wit: canonical WIT interface definition
• guest/: WIT-compatible plugin bindings for wasip1 — canonical cm.LowerString i32+i32 ABI, unsafe isolated to readFatPtr
• capabilities/: canonical module name podpedia:kernel/host-capabilities@0.3.0, safe mod.Memory().Read() on host side
• kernel/: high-level Kernel type — host app provides only Config{ModuleName, LogWriter}

Migration from v0.2.x

Plugins replace manual //go:wasmimport + abi.ReturnBytes calls with guest.HTTPPost(url, body) etc. No unsafe in plugin code.