WebAssembly reference types: implement instructions and multi-table runtime

Parent: #271 Depends on: #274 Roadmap: #263, #142, #134

Build the pinned reference-types instruction and table model on the precise reference-slot substrate.

Acceptance:

• Decode and validate externref/funcref positions, typed select, ref.null, ref.is_null, ref.func, table.get, and table.set.
• Support multiple typed tables and explicit table indices.
• Execute table.get/set/grow/size/fill with exact bounds, null, identity, and failure semantics.
• Implement JavaScript Table/Global/function boundary behavior for funcref and externref.
• Add stable disabled-feature diagnostics plus focused binary, validator, runtime, cross-instance, and API coverage.

First implementation slice landed in 70a2fb1f:

• decodes/gates reference value positions, typed select, ref.null, ref.is_null, ref.func, table.get/set, explicit call_indirect table indices, and table.grow/size/fill;
• carries table element types and multiple table indices through the IR;
• validates reference locals/globals/constants/stacks, typed vs untyped select, table types/indices, and function indices;
• executes funcref reference/table instructions with exact bounds and grow/fill behavior;
• checks imported table element-type compatibility.

Focused WebAssembly checkpoint: 149 passed, 0 skipped, 0 failed, 0 leaked. Remaining in #275: arbitrary externref table storage + GC mirrors, full multi-table/cross-instance runtime coverage, and JavaScript Table/Global/function boundary completion.

Second implementation slice landed in d2fca189:

• TableInst now stores tagged value slots rather than ambiguous nullable function pointers;
• funcref and arbitrary externref table get/set/grow/fill preserve their exact tags and identity;
• active element segments are constrained to funcref tables and imported table element types are link-checked;
• JavaScript WebAssembly.Table({ element: "externref" }) and WebAssembly.Global({ value: "externref" }) accept arbitrary JS values, preserve object identity, publish GC edges, and reclaim exactly after overwrite;
• existing anyfunc tables and cross-instance call_indirect remain green.

Focused WebAssembly checkpoint: 151 passed, 0 skipped, 0 failed, 0 leaked. README/docs are current at 7e9417c9. Remaining: reference-valued JS/Wasm function-call conversion, stronger explicit multi-table/cross-instance runtime coverage, and final acceptance audit.

Completed on main in the final implementation/evidence chain d3736891 → 5374e601, with documentation at bfb22343.

Acceptance evidence:

• binary/validator coverage includes reference value positions, typed select, ref.null, ref.is_null, ref.func, typed tables, stable disabled-feature diagnostics, and exact table/function indices;
• tagged funcref/externref slots execute exact table.get/set/grow/size/fill behavior and preserve arbitrary identity;
• JavaScript Table, Global, export, and import boundaries preserve externref identity and canonical funcref identity, including null, ordinary-function rejection, and mixed multi-value results;
• the explicit table-index witness uses table 1 for size/grow/fill/get/call_indirect while table 0 is a decoy, and calls a function owned by another instance.

The batched focused WebAssembly suite passes 153/153 at d3736891 with 0 skips, failures, or leaks. The strengthened explicit-table witness passes its focused 3/3 filter at 5374e601. README and detailed status are current at bfb22343; the public benchmark remains the validated July 17 1,540-sample matrix because these paths are outside its workloads.