feat(wasm): add browser WebAssembly support

[ddurst-nvidia]

Pull Request

Why

• Make the YamlSigil Rust implementation usable from browser-oriented
  wasm32-unknown-unknown consumers through a narrow JavaScript boundary.

What changed

• Make runtime dependency features compatible with browser WebAssembly and
  embed the optional signature schema at compile time.
• Add the unpublished, source-only yaml-sigil-wasm crate with typed
  compose, decompose, sign, and verify results.
• Validate selectors and key encodings at the JavaScript boundary, preserve
  stable error codes, and document copying and best-effort zeroization limits.
• Add Node.js and Firefox tests, a generated-JavaScript API smoke test,
  optimized size reporting, and temporary-artifact cleanup under
  cargo xtask wasm.
• Add WebAssembly validation to copied-head and protected hosted CI.

Review guide

• Start with crates/yaml-sigil-wasm/src/lib.rs for the exported API and
  result mapping.
• Review crates/yaml-sigil-wasm/tests/ for boundary and generated-binding
  coverage.
• Review xtask/src/wasm.rs, .github/workflows/ci.yml, and
  .github/workflows/pr-ci.yml for runtime validation, size measurement, and
  artifact cleanup.

Compatibility impact

• Existing native APIs and wire formats are unchanged.
• The workspace continues to require Rust 1.95.0.
• The new JavaScript API is unpublished and source-only.

Dependency and licensing impact

• Adds wasm-bindgen, js-sys, zeroize, wasm-bindgen-test,
  console_error_panic_hook, and tempfile; their licenses are MIT,
  Apache-2.0, or dual MIT/Apache-2.0.
• No executable WebAssembly, npm package, copied third-party source, or new
  third-party notice is included.

Related issue

Refs #5.

Testing

• cargo +1.95.0 xtask ci
• cargo +1.95.0 xtask wasm --candidate-root . with Node.js 22.23.2,
  Firefox 154.0, and wasm-pack 0.15.0: all 14 shared tests passed in Node.js
  and Firefox, the generated API smoke test passed, and no .wasm output was
  retained.
• RUSTFLAGS='-D warnings' cargo +1.95.0 check --locked --manifest-path xtask/Cargo.toml --target x86_64-pc-windows-gnu
• python3 -m unittest discover -s .github/scripts -p 'test_protected_pr_ci.py'
• actionlint 1.7.12
• shuck check .github/scripts
• Optimized web module measurements: 548,492 bytes by default and 3,411,426
  bytes with json-schema-validate.

Checklist

• I confirmed this belongs in the Rust implementation repository and is
  not a language-neutral specification change better handled in
  yaml-sigil-spec.
• I confirmed this change does not bypass or conflict with the public API
  contract in
  yaml-sigil-traits; any required
  traits changes are already available or tracked as coordinated work.
• I have the right to submit this contribution and every commit includes a
  Signed-off-by trailer.
• I understand and can explain this change.
• I updated documentation or tests where needed.
• I reviewed CONTRIBUTING.md and SECURITY.md.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[ddurst-nvidia]

/ok to test f0c4b05