ci: verify and refresh embedded WASI provenance

[pppolf]

What

• build the product WASI fixture only on the canonical Linux x86_64 / Rust 1.97.1 builder
• remap checkout and Cargo cache paths before compilation
• compare the rebuilt module byte-for-byte with the bytes Go actually embeds
• retain a mismatched canonical artifact for one day with SHA-256 diagnostics
• update the previously stale embedded module and its pinned digest

Why

CI rebuilt and assessed a fresh Rust fixture, while the product executed a separately tracked go:embed binary. The new gate immediately proved those bytes had drifted. The original raw Cargo command also embedded host-specific paths and crate identities, so macOS and Linux builds were not interchangeable.

Impact

The product now embeds the canonical Linux artifact (0252d60ef07a3f406df1e8f2e1b384e84b899aceca4c62ce1e68537aa19d283f). Future Rust source, lockfile, toolchain, path, or build drift fails CI before conformance checks. Non-canonical hosts fail closed instead of producing release bytes with a misleading digest.

Checks

• reproduced the original drift in GitHub CI and downloaded its exact artifact
• verified the replacement artifact with the production import/memory assessment
• go test -count=1 ./internal/analyzer
• focused embedded execution and pinned-digest tests
• non-canonical macOS builder rejection
• shellcheck scripts/build-embedded-wasi.sh
• bash -n scripts/build-embedded-wasi.sh
• actionlint -verbose .github/workflows/ci.yml
• git diff --check