feat: add wasmloader third-party module

[M09Ic]

Summary

• add an optional wasmloader module under malefic-3rd
• execute WASI-compatible bytecode with wasmi, including the wasix_32v1 IPv4 TCP imports used by REM's TinyGo build
• map ExecuteBinary fields to argv, environment, stdin, entry point, and BinaryResponse
• bound execution with configurable fuel, linear-memory, combined output, and host-sleep limits; filesystem access is not exposed
• keep WASM execution independent from the native malefic-rem backend

Why wasmi is optional

wasmi is required whenever the wasmloader feature is enabled. It is marked optional only so builds that exclude wasmloader do not compile or ship a WASM interpreter. The default full feature includes wasmloader, so normal full builds still include wasmi.

Validation

• 7 runtime/WASI/WASIX unit tests passed
• cargo check -p malefic-3rd --no-default-features --features wasmloader --target x86_64-unknown-linux-gnu --locked --offline
• cargo check -p malefic-3rd --no-default-features --features wasmloader,as_module_dll --target x86_64-unknown-linux-gnu --locked --offline
• built a 2,086,695-byte cmd/export_wasm fixture with TinyGo 0.40.1 / Go 1.25.6
• parsed, linked, instantiated, and executed the fixture's _start entry with status 0 and empty stderr

REM integration status

This validates the loader and REM module initialization, but not a complete REM data path yet. A real RemDial attempt against a local native REM server timed out. The current REM cmd/export_wasm source also calls the old two-callback SetPollHooks API while the current API accepts one callback, so the fixture required a temporary compatibility edit that was restored afterward.

The loader-side errno handling found during this test (random_get, TCP_NODELAY, and socket shutdown) is fixed in this PR. Full RemDial/MemoryDial validation still requires aligning the REM TinyGo export implementation with the current REM polling API.