feat(packer): add deterministic offline wasm packaging

[falloutmule]

Summary

• add generic static .wasm asset discovery and application/wasm handling
• embed emitted modules deterministically as data:application/wasm;base64,... in the one-file artifact
• add a neutral two-module fixture with repository-owned deterministic binaries
• prove zero-network execution over both HTTP and direct file://
• preserve the exact JavaScript-only control artifact byte count and SHA-256
• cover multiple WASM assets plus missing, oversized, corrupt, and unsupported-runtime-fetch cases

Verification

• pnpm install --frozen-lockfile --offline
• pnpm run lint
• pnpm run typecheck
• pnpm run test — 277 passed, 2 skipped
• pnpm run check
• neutral fixture inspect, validate, check, pack, verify, HTTP smoke, and file:// smoke
• repeated generation and packing produced byte-identical modules and HTML
• external requests: 0; .wasm sidecar requests: 0; browser errors: 0

Boundaries

V1 supports statically imported .wasm URLs. Arbitrary relative runtime fetches are rejected, and semantic WebAssembly validation remains an application/runtime responsibility.

The pinball laboratory was the donor use case, but no pinball, physics, Rapier, package-name, or engine-specific assumptions entered the framework implementation.