feat: run programs under wasmtime

[clearloop]

berm now compiles a program under wasmtime or, experimentally, under rvtime. Which backend a deploy reaches is read off the image's first four bytes, so one bermd runs either and nothing has to be declared or configured. wasm is the default; rvtime is behind --features riscv.

One ABI, not two

The risk in a second backend is the ABI drifting between them, so the seam is drawn to make that impossible. Every syscall — berm's own and the embedder's — is written once in crates/berm/src/syscall/mod.rs against a four-method Guest trait and assembled into one table keyed by the hashed name. rvtime registers one host function per number; wasmtime registers a single import, berm.syscall, and looks the number up in that same table. A backend supplies transport and nothing else.

Manifest::from_image reads the .berm.abi section out of either format through one reader, because #[link_section] emits an ELF section and a wasm custom section under the same name.

ABI break

ABI_VERSION is 1, and an image built against 0 is refused. A tool export now takes nothing and returns nothing, answering through berm.done or berm.fail; Buf is gone. The old convention could not survive the move — extern "C" fn() -> Buf compiles to a hidden out-parameter on wasm32 — and staging the result is how everything else on this wire already travels.

Verified

• The same fixture source, built for both targets and run under both backends, produces identical output for nest, refusal-vs-failure, and depth limiting.
• Through a real bermd: deploy, the tool paths, tick (store and timer syscalls, with wakes firing), the wasmtime code cache, and restore across a restart.
• The sniff's negative paths: an ELF against a wasm-only build, and a garbage image, are both refused with the right message.
• berm new and berm new --target riscv each scaffold, build, and pass their own tests.
• fmt and clippy clean under -D warnings for wasm-only, riscv-only, and both.
• Every commit here was checked out and built on its own.

wasm measures 141 KB image / 31 ms cold compile / 14.5 µs p50, against rvtime's 408 KB / 139 ms / 24.8 µs.

Not verified

The rvtime test suite never completed a run locally. No commit here touches rvtime/, so CI is the check on that.

Note

The branch also carries three earlier commits that were not yet on main (aa58f61, 91cc322, c649b46), so this PR shows eight commits rather than five.