fix(bazel): pin rules_wasm_component via git_override (Rocq Proofs unblocker)

MODULE.bazel

@@ -86,4 +86,19 @@ register_toolchains("@rocq_toolchains//:all")
 # Bundles the `witness` toolchain (toolchains/witness_toolchain.bzl) and
 # the `wasm_module_coverage` rule, which is how we produce MC/DC coverage
 # evidence on the feature-model composition core (REQ-086).
+#
+# Not in the Bazel Central Registry — pinned via git_override to a
+# specific commit on pulseengine/rules_wasm_component, mirroring the
+# rules_rocq_rust pattern above.
 bazel_dep(name = "rules_wasm_component", version = "1.0.0")
+
+git_override(
+    module_name = "rules_wasm_component",
+    remote = "https://github.com/pulseengine/rules_wasm_component.git",
+    # d2347fb: chore(deps): bump PulseEngine toolchains (#471) — current
+    # main HEAD on rules_wasm_component. The earlier fbe2057 pin no
+    # longer resolves under Bazel's shallow git fetch on self-hosted
+    # runners (it's still in upstream history; the issue is shallow
+    # depth), so track HEAD instead.
+    commit = "d2347fbf79ee5d4e20de0df7e8c1bb3adadf5cfe",
+)