feat(oci): convert the whole cascade to no_std — WASI-free, no-grow (OCI-P02)

[avrabe]

All eight components now build no_std for wasm32-unknown-unknown: zero wasi:* imports and zero memory.grow each. memory.grow is what makes meld fuse --memory shared --address-rebase reject a component (gale#89, meld#299), so this is what lets the fused cascade lower to a single-address-space MCU image.

Previously only rate was converted — and the others' WASI imports were publicly visible on their wasm.directory listings (falcon-iekf and falcon-attitude carried 14 each).

Measured

component	before	after
flight	106,834	34,988
iekf	60,894	11,675
position	57,071	7,525
attitude	53,570	4,086
mixer	16,103	2,964
rate	3,908	4,026

(+ ekf 4,801 B and cascade 6,321 B, bundled but not published.)

Shared runtime, not six copies

Each conversion needs the same three pieces — bounded work-memory arena, the canonical-ABI cabi_realloc export (wit-bindgen-rt supplies it only when std is linked), and a panic handler — roughly 60 lines of unsafe per component. Factored into crates/falcon-cm-rt with an export_cm_rt!() macro, since #[global_allocator]/#[no_mangle]/#[panic_handler] must be defined in the final artifact while the logic can live in one audited place.

rate was retrofitted onto it: 214 → 95 lines, byte-identical behaviour.

Two things thread_local! was hiding

1. It is std — the sole reason these components imported WASI at all.
2. It allows lazy init, while a plain static needs a const one. Iekf::level() isn't const (it builds a NavState), so iekf now lazily initialises through an Option. Making the constructor const would have meant editing relay-iekf, a Kani-verified flight crate, for the sake of a static — not worth it.

Honest note on Bazel

Six Bazel targets opt into std explicitly: rules_rust can't build the no_std variant yet (no crate_universe dep, no genuine no_std config — it fails on a duplicate panic_impl lang item). The two build paths still differ, as documented; converging them remains the open follow-up.

Verified per component

Header 0061736d0d000100, wasm-tools-measured 0 wasi / 0 memory.grow, and the through-wasm closed-loop proof unchanged — 0.193 s, |err| 0.0059 rad/s. rivet validate PASS.

Stacks on #337. Refs: SWREQ-FALCON-OCI-P02, #336.

🤖 Generated with Claude Code

[avrabe]

Auto-merge temporarily disabled to enforce stack order.

This branch is stacked on #337 — it carries fcee587 (the WIT namespace rename) as well as its own d6602c3. If it merged first, the rename would land squashed under this PR’s title and #337 would become an empty PR, which would misattribute OCI-P04’s implementation in the trace.

Order: #337 → #339 → #340. Auto-merge goes back on here once #337 lands and this branch is updated.

🤖 Generated with Claude Code

[avrabe]

Rebased onto main after #337 landed, and auto-merge re-enabled — stack order held (#337 → #339 → #340).

The update hit the expected squash-merge stacked-PR conflict: main now carries the WIT rename as a squashed commit, while this branch still carried the original fcee587. Resolved by rebasing and skipping that commit, after confirming main already has everything it carried:

• wit/falcon-cascade/cascade.wit → package pulseengine:falcon-cascade@0.7.0
• SWREQ-FALCON-OCI-P04 → implemented
• stale falcon:cascade references under wit/ → 0

Post-rebase verification on this tree:

• no_std components: 8/8
• export_cm_rt: 8/8
• rivet validate → PASS, exit 0 — run with v0.19.0, the version the gate pins (local rivet is 0.28.0 and disagrees: 352 vs 108 warnings, so a local 0.28 pass is not gate evidence)

🤖 Generated with Claude Code