WebAssembly Core 3: implement typed function references end to end

Parent: #366 Related: #267, #142 Roadmap: #134

The exact wg-3.0 typed-function-reference boundary is implemented without weakening the profile.

Acceptance:

• Decode both opcodes and preserve their type-index immediates.
• Validate operand/reference subtyping, nullability, result types, and tail-call result compatibility exactly.
• Execute direct typed references with null and signature-mismatch traps.
• Cover GC relocation and cross-module canonical function-reference identity.
• Pass every command in the exact wg-3.0 typed-function-reference files, including call_ref.wast and return_call_ref.wast.
• Add focused unit and bounded upstream-corpus CI evidence.

Delivered in b8e4b2f and af1d2e1.

Implementation is now on main in b8e4b2f.

Evidence:

• zig build test -Dtest-filter=wasm. -Doptimize=Debug: 269/269 pass, zero leaks.
• exact wg-3.0 call_ref.wast: 35/35 pass.
• exact wg-3.0 return_call_ref.wast: 51/51 pass, including million-step tail recursion.
• python3 -m unittest tools/test_wasm_spec.py: 17/17 pass.

Implemented both opcodes and feature gates, nominal operand/result subtyping, covariant tail results, null and signature-mismatch traps, module-aware concrete-function slot initialization, and cross-instance canonical-type coverage. I am keeping the issue open only long enough to land the bounded Core 3 CI witness required by the final acceptance item.

Completed on main in b8e4b2f and af1d2e1. The exact Core 3 files pass 35/35 and 51/51, the complete focused Wasm unit batch passes 269/269 with zero leaks, and the shared pinned wasm-tools CI leg now executes both files.