0.2.0 Track D: WASM lint coverage — fix static_mut_refs + bazel build CI job

[avrabe]

Summary

Closes out the WASM-binding hygiene items in #14. Two parts:

1. Fix static_mut_refs (Rust 2024) in all 6 wasm_component.rs files. Replaces the static mut TABLE: Option<...> + fn get_table() -> &'static mut ... pattern with OnceLock<Mutex<T>> + a with_table(|t| ...) closure helper. Stable, no unsafe, no nightly, no new deps. Identical idiom across all 6 crates.
2. Add a bazel-build CI job that runs bazel build //:all — exercises the 6 rust_wasm_component_bindgen targets so future drift in rules_wasm_component (or in these files) is caught at the gate. Mirrors the Verus job's pattern: pinned relay + rules_wasm_component siblings with fetch-depth: 0, pinned cachix/install-nix-action SHA, bazel-contrib/setup-bazel@0.15.0.

Also removes the dead pub const MAX_OUTPUT_QUEUE: usize = 16; from crates/wohl-alert/src/wasm_component.rs.

Why this matters

Each monitor crate's [lib] points at plain/src/lib.rs, so cargo's --workspace clippy/fmt never sees src/wasm_component.rs. Until now the WASM-binding glue had zero lint coverage. The new bazel build //:all job is the standing gate, and the static_mut_refs fix removes the existing offender so the gate goes green on day 1.

Verified locally

• cargo +1.85.0 clippy --workspace --all-targets -- -D warnings — clean (no regression — cargo still doesn't see these files; sanity-check that nothing else broke).
• cargo test --workspace --offline — clean.
• YAML parses on the updated ci.yml.
• bazel build //:all could not be run locally (no nix on this dev host); the new CI job is the verification path.

Open follow-ups

• Pre-existing unformatted style in the 6 wasm_component.rs files (compressed enum/struct one-liners). Not reformatted in this PR — a separate cosmetic-cleanup PR could rustfmt them.
• The new bazel-build job pulls relay even though //:all may not require it; kept for symmetry + future-proofing. Could be trimmed once proven unnecessary.
• MAX_OUTPUT_QUEUE still exists in crates/wohl-alert/plain/src/engine.rs:23 and crates/wohl-alert/src/engine.rs:19 — those are behind the Verus/Kani gate (verified source) and explicitly out-of-scope for this lint PR.

🤖 Generated with Claude Code