feat(wasm): Add sandboxed UDF runtime

[rahulbsw]

Summary

Adds production-oriented, stateless WebAssembly UDF support to StreamForge
using the Wasmtime component model.

• adds versioned WIT worlds for envelope-aware filters, JSON value transforms,
  and mutable envelope transforms
• composes stages as filter → value transform → envelope mutations, with native
  logic preceding the corresponding UDF stage
• verifies digest-pinned local components before Kafka startup and rejects WASI
  or other unresolved imports
• enforces execution, input/output, memory, table, stack, artifact, and
  concurrency limits
• integrates typed fail, DLQ, skip-and-log, and continue policies without
  rerunning successful destinations
• adds bounded-label metrics, operator ConfigMap/PVC delivery, hardened pod
  settings, and rollout checksums
• includes a Rust guest SDK, runnable fixtures, WIT ABI, usage documentation,
  configuration schema, and roadmap updates

Why

StreamForge needs custom policy and transformation logic beyond the native DSL
without loading native plugins or granting ambient filesystem, network,
environment, clock, or random access. The component boundary provides a
versioned ABI while digest verification and explicit resource limits keep the
extension point bounded and auditable.

Wasmtime is pinned to the security-patched 36.0.10 release. Dependency audit
failures now block CI, and CI compiles all guest examples and verifies fixture
digests.

User and developer impact

UDFs are opt-in. Configurations without a top-level wasm registry retain the
existing native path and do not initialize Wasmtime.

This aligns native destination processing with the documented order: value
transforms now precede native key/header/timestamp envelope mutations. Pipelines
that derived envelope fields from values removed by the value transform must
retain those inputs or update their envelope rules.

See docs/WASM_UDFS.md and udf-sdk/rust/README.md for configuration, ABI,
build, deployment, security, and performance guidance.

Validation

• cargo test --all --locked --offline --no-fail-fast: 525 passed, 30 ignored,
  0 failed
• cargo clippy --all-targets --all-features --locked --offline -- -D warnings
• cargo audit --no-fetch --ignore RUSTSEC-2024-0437: zero vulnerabilities;
  seven warnings inherited from main
• release build for streamforge and streamforge-validate
• release validator loaded, verified, compiled, linked, and probed the
  digest-pinned smoke component
• operator: 7 tests, warnings-denied Clippy, formatting, and Helm lint
• all three Rust guests compile for wasm32-unknown-unknown
• fixture SHA-256 manifest, JSON schema, workflow/CRD YAML, package contents,
  formatting, and diff checks passed
• complete WASM Criterion target and isolated no-UDF controls completed; local
  controls remained within the 3% diagnostic budget
• loopback Kafka smoke reconciled 7,599,000 records exactly with zero processing
  errors; the 30-second dirty-worktree result is diagnostic and not a
  publication claim

Controlled same-revision A/B performance runs remain the release gate;
shared/local timings are retained as development evidence only.