feat(wasm): add Nava-hosted build

[billyhunt]

Summary

• add a compile-time tracking disable for managed/private builds
• build and verify the Nava multithreaded WebAssembly artifact in CI
• reject bundles containing the upstream tracking endpoint, CORS proxy, or COI service-worker workaround

Validation

• shell syntax checks passed
• workflow YAML parsed successfully
• bundle verifier positive and negative fixture checks passed
• git diff --check passed

Deployment dependency

The artifact is intended for the cross-origin-isolated Quick Launch stack in https://github.com/navapbc/nava-quicklaunch/pull/3.

[billyhunt]

Deployment validation:

• WebAssembly job passed: https://github.com/navapbc/graphia/actions/runs/29850945527/job/88703365503
• downloaded artifact contained the expected eight static assets
• scripts/verify-wasm-bundle.sh passed against the real artifact
• uploaded artifact is commit 189fbab8e

The unrelated macOS job failed because the runner no longer provides the legacy AGL framework (ld: framework AGL not found); the WebAssembly, Linux, Windows, Clang, QML, Clazy, cppcheck, and IWYU jobs passed or were still completing in the push run.