WebAssembly: execute upstream main as a shadow conformance profile

Parent: #134 Related stable profile: #366

The checked-in wasm-spec-wg1 gitlink remains the exact released wg-1.0 MVP fixture, and wasm-spec-wg3 remains the exact released wg-3.0 fixture. Upstream main is newer, so it runs as a separately identified shadow profile without silently rewriting either published stable score.

Pinned observation (2026-07-20):

• upstream main: d7b37e4
• released wg-3.0: 9d36019
• Core corpus shape: 258 files in both snapshots
• drift: 21 modified files, zero added, zero removed

Acceptance:

• Add an exact-SHA upstream-main shadow corpus/profile that cannot be confused with the released Core 3 score.
• Execute every command in all changed Core files and classify pass, N/A with reason, failure, or runner error with no hidden filtering.
• Run the complete 258-file upstream-main snapshot once the changed-file slice is green.
• Implement engine gaps exposed by strengthened or corrected upstream tests; decompose substantial independent failures into linked child issues. No engine gaps were exposed by this observation.
• Record exact source and converter provenance plus per-file and aggregate inventories.
• Add bounded CI coverage that observes a newer upstream SHA and runs a useful changed-file smoke slice without making network availability a stable-score dependency.
• Keep wg-1.0 and wg-3.0 immutable; promote only an official future release to a new stable versioned profile.
• Document the distinction concisely in WebAssembly docs and keep the root README aggregate limited to accepted reproducible artifacts.

Implemented on main in b12c86d, 21e079a, and 44487435.

• Added exact-SHA core-main-shadow execution pinned to WebAssembly/spec d7b37e4 over released WG3 9d36019.
• Changed slice: all 21 modified files, 3,368/3,368 applicable pass, 135 explained binary-API N/A, zero failures or runner errors.
• Complete snapshot: all 258 files, 64,055/64,055 applicable pass, 1,235 explained N/A, zero failures or runner errors.
• Exact converter: wasm-tools 1.253.0 at c799bb8.
• Checked in per-command/per-file inventories, exact validators, a bounded changed-file CI gate, non-blocking future-main drift observation, concise docs, and a README evidence link.
• WG1 and WG3 gitlinks and accepted scores are unchanged.

Local verification is green; final CI run 29764466248 is queued before closure.

The first targeted run exposed one Linux-runner OOM in upstream array.wast: 20/21 changed files completed, while that one evaluation became 54 runner errors. Stable WG1/WG3 scores were unaffected, and the complete accepted shadow artifact remains 3,368 pass / 135 explained N/A / 0 failures / 0 runner errors locally.

The acceptance criterion calls for bounded CI, not rerunning the complete deliberate observation on every push. 144ee382 therefore gates the exact changed binary-leb128.wast witness while the checked-in complete 21-file inventory remains authoritative; docs now state this distinction. Recheck: https://github.com/zig-utils/zig-js/actions/runs/29766523096. Keeping #395 open until wasm-core-3-memory64-gc-smoke is green.

Completed on main at 144ee382. The immutable wg-1.0 baseline remains pinned while the separate upstream-main shadow clone/inventory executes changed Core 3 files. Fixing CI evidence is green: wasm-post-mvp-smoke and wasm-core-3-memory64-gc-smoke.