WebAssembly exceptions: JavaScript Tag/Exception API and identity boundaries

Parent: #266 Depends on: #290 Roadmap: #142, #134

Implement the pinned WebAssembly exception JavaScript API and exact JS/Wasm identity behavior.

Acceptance:

• Implement the revision-matched WebAssembly.Tag and WebAssembly.Exception constructors, prototypes, branding, reflection, and payload accessors.
• Enforce exact descriptor evaluation order, type conversion, arity, range, and incompatible-receiver errors.
• Preserve Tag and Exception identity through imports, exports, JS callbacks, Wasm throws/catches, rethrows, async instantiation rejection, and cross-instance linking.
• Root reference payloads and wrappers across precise GC; release native/wrapper ownership exactly once on failure and teardown.
• Add differential system-engine tests only where the public embedding API exposes equivalent behavior.

Completed in 32439ec, e6e6c13, 00d1cc6, e9a86e3, and 4c4a77f. Verification: broad WebAssembly API 34/34 with zero leaks; focused exception transport under ThreadSanitizer 3/3 with no races or leaks; exception executor 8/8 including allocation-failure and concurrent-publication coverage; 10/10 equivalent public JavaScript API rows match system JavaScriptCore with digest 1bb6039. README, WebAssembly docs, and the feature drift verifier now publish and enforce the boundary. Exact upstream proposal-corpus accounting remains intentionally owned by #292.