WebAssembly corpus: add a bit-exact runner for NaN payload assertions

Parent: #260 Roadmap: #141, #134

Problem

The pinned wg-1.0 corpus currently has 151 assert_return commands whose action arguments or expected results contain an exact f32/f64 NaN payload or sign. All 151 otherwise-unexplained result mismatches are in this class.

The current corpus evaluator deliberately exercises the public JavaScript WebAssembly API. That boundary represents WebAssembly floats as JavaScript Number, so it cannot reliably carry every f32/f64 NaN payload/sign bit pattern. Treating these commands as engine failures would be misleading; treating them as silently passed would weaken the score.

Complete implementation

• Add a corpus execution path that can pass f32/f64 arguments and collect results as raw WebAssembly bits.
• Keep module decoding, validation, imports, linking, start functions, traps, registrations, and mutable store state equivalent to the public API path.
• Score exact-NaN assert_return commands through that path without canonicalizing the expected or actual values.
• Retain public-API scoring for commands that are observable exactly through JavaScript.
• Add focused regression coverage for positive/negative canonical and arithmetic NaNs, payload preservation, memory round trips, locals/select, and conversions.
• Record the runner mode/reason per command in the machine-readable inventory.
• Regenerate the full pinned wg-1.0 inventory and update README/docs evidence.

Acceptance

• No exact NaN payload/sign command is classified as a zig-js runtime failure merely because JavaScript Number erased the distinction.
• Every such command is either passed by the bit-exact runner or remains an explicit, issue-linked limitation in the inventory.
• zig build wasm-spec remains strict: genuine applicable failures and runner errors fail the command.

Current inventory checkpoint: af689c4 records 2,039 exact-NaN commands as explicit, issue-linked JavaScript-boundary limitations. The original 151 mismatches were the subset that happened not to canonicalize to the expected bits; the runner now classifies the entire unobservable class consistently. All remaining JavaScript-observable MVP commands pass (16,801 pass, 0 fail, 0 runner errors).

Completed on main.\n\n- Test-only Context hook passes/returns raw MVP scalar bits without changing ordinary WebAssembly globals or API surface (6630a05).\n- Corpus runner routes every exact-NaN argument/result/global assertion through raw bits and records per-command execution mode in schema v2 (977d02c).\n- Full pinned wg-1.0 result: 18,840 pass, 0 fail, 430 explicit text-parser-only not-applicable, 0 runner errors; modes are 16,801 javascript_api, 2,039 bit_exact, 430 not_applicable (43f884b).\n- CI now gates linking.wast plus all f32_bitwise.wast bit-exact cases (f61b6dd).\n- Focused WebAssembly suite passes 123/123 with zero skips, failures, or leaks.\n- README.md and docs/wasm.md publish the final score and boundary (1f86d79).