Upgrade Wasmtime to 48 and add native WASI P3 build lane

[lthibault]

Why

Wetware needs a stable substrate for the future WASI P3 migration without changing production guest behavior in the same change. Wasmtime 48 provides the required foundation, but its fuel hooks, socket defaults, and filesystem APIs differ from Wasmtime 45. This PR preserves current P2 Cell behavior and adds a reproducible native-P3 build lane before later migration work changes guest scheduling or transport.

Summary

• upgrade wasmtime, wasmtime-wasi, and wasmtime-wasi-io to 48.0.1 while preserving the current P2 guest runtime;
• adapt fuel, call-hook, socket, and filesystem behavior for Wasmtime 48 parity;
• add a pinned native wasm32-wasip3 fixture build lane;
• validate the fixture with wasm-tools and reject any WASI 0.2 imports.

Runtime behavior

Production remains P2-only.

This PR does not migrate std/system, PID0, kernel/status, or other guests to P3. It does not add the future P3 transport.

Important Wasmtime 48 parity adaptations

• preserve Wasmtime-45-style flat fuel accounting by zeroing new size-dependent variable operator costs;
• distinguish real linked host calls from internal fuel/yield call-hook events before EWMA refueling;
• explicitly restore Wasmtime-45 TCP/UDP socket-creation defaults without granting reachable network destinations;
• migrate filesystem permission and resource APIs without changing image/IPFS read-only or /tmp read-write semantics;
• explicitly keep production Component Model async disabled.

Native P3 lane

Pinned tuple:

• Rust nightly 2026-08-30 / LLVM 23.1;
• rust-src with -Z build-std=std,panic_abort;
• wasm32-wasip3;
• WASI SDK 34;
• wasm-component-ld 0.5.30;
• LLD 23.1;
• wit-bindgen 0.61.1;
• wasm-tools 1.258.0;
• Wasmtime 48.0.1.

The fixture is intentionally minimal and contains no Wetware runtime, Tokio, or Cap'n Proto.

Validation

• workspace checks and Clippy passed;
• current P2 WASM artifacts built and passed their artifact assertions;
• the full Rust workspace tests passed with required Kubo coverage, including artifact-dependent integration suites;
• standalone kernel and status tests passed;
• architecture-map and release tests passed;
• the native-P3 fixture built and passed wasm-tools validation with 14 WASI 0.3 imports and zero WASI 0.2 imports;
• Foundry formatting, build, and tests passed;
• git diff --check passed.

The checksum-pinned Linux P3 lane will receive its first GitHub Actions execution on this PR.

Architectural context

This PR is substrate only for a separately reviewed future P3 migration. Production guest scheduling remains unchanged.