WebAssembly Core 3: complete typed reference refinement validation

Parent: #366 Related: #384, #267, #134

The exact Core 3 audit exposed two validation holes in typed reference control flow; both are now fixed on main.

Exact evidence at WebAssembly/spec@9d36019973201a19f9c9ebb0f10828b2fe2374aa:

• test/core/br_on_non_null.wast: 12/12 pass. A nullable label accepts the non-null subtype carried on the branch while fallthrough retains the nullable path.
• test/core/ref.wast: 13/13 pass. Explicit typed select validates concrete heap indices even on unreachable-polymorphic stacks.

Acceptance:

• Implement exact br_on_non_null branch/fallthrough reference refinement and block-result interaction.
• Cover concrete function, abstract func, and extern hierarchies plus unreachable-polymorphic inputs.
• Validate explicit reference result types on select, including heap type index bounds.
• Pass both exact files with zero failures or runner errors.
• Add focused decoder/validator units and bounded CI witnesses.

Evidence:

• Focused validator slice: 3/3 pass, zero leaks.
• Exact corpus: 25/25 pass across both files.

Landed on main:

• bdbf86b5 fix(wasm): validate Core 3 reference refinement (#388)
• c5344a8b ci(wasm): gate Core 3 reference refinement (#388)
• 7c47385d docs(wasm): narrow the Core 3 residual (#366)

Implemented and pushed to main. Both exact files are green; #389 now owns the final six Core 3 assertions.