wsc v0.9.4

What's Changed

• ci(fuzz): cap nightly fuzz matrix at max-parallel 2 (#146) by @avrabe in #168
• ci(witness): wire MC/DC harness as a gating regression check (#128, #165 Track C) by @avrabe in #169
• chore(deps): bump imjasonh/setup-crane from 0.4 to 0.7 by @dependabot[bot] in #173
• chore(deps): bump toml from 0.9.12+spec-1.1.0 to 1.1.2+spec-1.1.0 by @dependabot[bot] in #177
• chore(deps): bump maybe-async from 0.2.10 to 0.2.11 by @dependabot[bot] in #178
• chore(deps): bump serde_json from 1.0.145 to 1.0.150 by @dependabot[bot] in #182
• chore(deps): bump anyhow from 1.0.102 to 1.0.103 by @dependabot[bot] in #183
• plan(embedded): rivet plan + cross-repo links for on-target trust chain (#187) by @avrabe in #188
• plan(embedded): fold in kiln#421 + gale#164 feedback — curve agility + hardware-verify (REQ-17) by @avrabe in #189
• plan(embedded): trace #190 varint overflow certificate into FEAT-12 (REQ-18) by @avrabe in #191
• fix(release): sign wsc-cli.wasm (wasip2) as a hard requirement — #164 stale by @avrabe in #192
• plan(embedded): REQ-18 dep → ordeal v0.13.0 (re-sequenced) by @avrabe in #193
• plan(embedded): wasm-component->meld->loom->synth delivery (DD-9) + gale#164 no-alloc/extern-C into REQ-15 by @avrabe in #194
• chore(deps): bump bazel-contrib/setup-bazel from 0.14.0 to 0.19.0 by @dependabot[bot] in #171
• chore(deps): bump pulseengine/rivet from 0.17.0 to 0.22.1 by @dependabot[bot] in #172
• chore(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #174
• chore(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #175
• chore(deps): bump actions/attest-build-provenance from 2 to 4 by @dependabot[bot] in #170
• chore(deps): bump tss-esapi from 7.6.0 to 7.7.0 by @dependabot[bot] in #176
• chore(deps): bump tracing-subscriber from 0.3.22 to 0.3.23 by @dependabot[bot] in #180
• chore(deps): bump webpki-roots from 1.0.3 to 1.0.8 by @dependabot[bot] in #181
• chore(deps): bump serde_jcs from 0.1.0 to 0.2.0 by @dependabot[bot] in #184
• chore(deps): update wasmtime requirement from 46.0 to 47.0 in /examples/wasmtime-loader by @dependabot[bot] in #196
• chore(deps): bump wasmtime from 45.0.2 to 47.0.1 by @dependabot[bot] in #197
• chore(deps): bump hmac-sha256 from 1.1.12 to 1.1.14 by @dependabot[bot] in #201
• chore(deps): bump wat from 1.252.0 to 1.254.0 by @dependabot[bot] in #198
• chore(deps): bump pulseengine/rivet from 0.22.1 to 0.28.0 by @dependabot[bot] in #195
• chore(deps): bump webpki-roots from 1.0.8 to 1.0.9 by @dependabot[bot] in #204
• chore(deps): bump tokio from 1.49.0 to 1.50.0 by @dependabot[bot] in #205
• chore(deps): bump log from 0.4.28 to 0.4.33 by @dependabot[bot] in #206
• chore(deps): bump rustls-pki-types from 1.12.0 to 1.15.1 by @dependabot[bot] in #207
• chore(deps): bump thiserror from 2.0.17 to 2.0.19 by @dependabot[bot] in #208
• chore(deps): bump ureq from 3.1.2 to 3.3.0 by @dependabot[bot] in #209
• chore(deps): bump pulseengine/rivet from 0.28.0 to 0.30.0 by @dependabot[bot] in #203
• chore(deps): bump taiki-e/install-action from 2 to 2.85.6 by @dependabot[bot] in #211
• fix(bazel): bare @wsc_deps//:ureq alias — unbreaks the release (ureq 3.1.2→3.3.0 drift) by @avrabe in #212
• fix(parser): raise MAX_SLICE_LEN to 256MB — large wasip2 components sign (#164, unbreaks release) by @avrabe in #213
• fix(witness): refresh MC/DC baseline 12→17 (std/dep churn) + document whole-wasm limitation (#128) by @avrabe in #214
• release: v0.9.4 — unbreak release + real #164 fix (sign large wasip2 components) by @avrabe in #215

Full Changelog: v0.9.3...v0.9.4