CI: accept pinned wasm-tools source version metadata

Context

Main run 29716133711 failed only in wasm-memory64-gc-smoke before corpus execution. The checksum-pinned wasm-tools 1.253.0 release now reports wasm-tools 1.253.0 (c799bb87b 2026-07-07) instead of the bare semantic version expected by the driver.

The downloaded archive checksum, semantic version, and source commit still match our pins. The verifier should understand both official version formats while rejecting version or commit drift.

Acceptance

• Accept the bare release form and the source-metadata form emitted by wasm-tools 1.253.0.
• When a commit is advertised, require it to be a prefix of the pinned full commit.
• Reject semantic-version drift, commit drift, and malformed suffixes.
• Keep the release archive checksum pin in CI unchanged.
• Cover the behavior with focused driver tests.

Related: #134, #142, #267, #300

Fixed on main in aed1978. The verifier accepts the bare release form and the exact source-metadata form emitted by the checksum-pinned archive, validates any advertised hash as a prefix of c799bb8, and rejects version/hash/malformed drift. Focused driver tests pass 16/16. The previously failing wasm-memory64-gc-smoke is green in replacement main run 29716788619 (job 88271567398).