feat(wasm-host): W2 minimal WASI preview1 subset for scoot-wasm

[jamiesun]

What

Implements W2 of the scoot-wasm plan (#100): a deliberately small,
capability-safe WASI preview1 subset so a wasm32-wasi command module can
read stdin, write stdout/stderr, and exit. Run with:

scoot-wasm wasi <module.wasm> [args...]

The host instantiates the module, runs its start section and _start export,
pipes this process's stdin to fd 0, forwards the module's stdout/stderr, and
exits with the module's proc_exit status (a normal _start return exits 0).
This is the intended subprocess host for the external compression plugins of #98
(host = "scoot-wasm wasi <component>", JSON-in/JSON-out over stdio).

W0 (#145) and W1 (#147) are merged; this is the next independent phase PR.

Exposed WASI surface

Everything else traps — capability-safe by construction:

• args_sizes_get / args_get, environ_sizes_get / environ_get
• fd_read (fd 0), fd_write (fd 1/2), fd_close
• fd_seek (stdio -> ESPIPE), fd_fdstat_get (stdio character device)
• clock_time_get (realtime/monotonic), random_get (seeded/deterministic)
• proc_exit

No filesystem or network functions are implemented. environ is empty by
default (the host environment is never leaked). Out-of-bounds guest pointers
return EFAULT instead of corrupting host memory; bad fds return EBADF. The
engine performs no real IO: the host supplies clock nanos and a random seed,
and splitmix64 generates random bytes deterministically.

Boundary

The WASI layer is compiled only into the standalone scoot-wasm binary
(-Dwasm-host=true); the zero-dependency core never links it. Default
zig build still builds only scoot.

Tests

Adds 11 hand-built wasm fixtures (no toolchain dependency) covering: echo
stdin->stdout, args/env round-trip, proc_exit codes, fd_write nwritten,
random_get determinism, bad-fd errno, OOB pointer -> EFAULT, and
unknown-import traps. zig build test is green (all engine tests run
unconditionally).

Verification

• zig build -Dwasm-host=true
• zig build test (incl. 11 new WASI tests)
• Local CI (fmt / Debug build / test / ReleaseSafe / CLI smoke)
• End-to-end: a generated echo.wasm round-trips Hello, WASI world! and exits 0;
  an exit42.wasm exits 42; a missing module prints FAIL to stderr and exits 1.

Docs

Updates docs/WASM_TOOLS.md (+.zh) and CHANGELOG.md (+docs/CHANGELOG.zh.md).

Refs #100