Spec: Security Contexts (FFI/WASM/CLI)

[flyingrobots]

Define security contexts and deterministic resource limits for FFI/WASM/CLI: memory/time/recursion caps; UTF-8/path checks; overflow-safe math.