WebAssembly Core 3: reconcile element and reference import subtyping

Parent: #366 Related: #263, #267, #134

The exact Core 3 audit found reference-subtyping gaps at element/table and immutable-global link boundaries.

Acceptance:

• Derive and validate the exact reference type of legacy and expression element segments.
• Accept valid initialization of non-nullable function-reference tables while retaining null/defaultability rejection rules.
• Apply covariance to immutable reference globals at link time and keep mutable globals invariant.
• Preserve canonical recursive type identity across instances.
• Pass the affected exact commands in elem.wast and linking.wast with zero regressions.
• Add focused validation/link units and bounded CI witnesses.

Completion evidence:

• Implementation: 7b393b9e
• Bounded CI: 0b23e3fe
• Exact elem.wast: 151/151 applicable, zero fail/N/A/runner
• Exact linking.wast: 163/163 applicable, zero fail/N/A/runner
• Full pinned Core 3 audit: 63,964/63,964 applicable, 1,235 text-format N/A, zero fail/runner
• Terminal inventory and matrix: aa70d874

Completed and published on main. Legacy function-index segments now carry exact non-null (ref func) types; immutable cross-instance global imports use canonical covariant reference matching while mutable imports remain invariant. The focused files and the complete 258-file Core 3 audit are green.