[WAF-60] Establish the STX local-link, pinned-CI, and embedded-asset pipeline

Objective

Develop through the local STX checkout, pin its CI commit, generate typed clients, fingerprint and compress assets, create CSP hashes, embed assets in Zig, and require no Bun runtime in production.

Deliverables

• Implement the complete scoped behavior described above.
• Keep request-path work independent from UI, PostgreSQL, and blocking audit I/O.
• Use Zig 0.17-dev and dependencies pinned through Pantry; do not add Git submodules.
• Keep public APIs explicit about ownership, resource limits, errors, security policy, and compatibility.
• Add focused unit, integration, differential, fuzz, benchmark, and documentation coverage as applicable.

Acceptance criteria

• The scoped implementation and tests are merged on main in small conventional commits.
• Zig formatting, focused tests, and the relevant CI suite pass.
• Compatibility claims have executable evidence and no unexplained skips or silent fallbacks.
• Untrusted inputs have deterministic bounds; hot paths have benchmark evidence.
• Documentation and the machine-readable compatibility matrix are updated.

Relationships

• Parent: WAF-00

Blocked by

• WAF-02
• WAF-48

Blocks

• WAF-61
• WAF-62
• WAF-63
• WAF-65
• WAF-66
• WAF-67
• WAF-68
• WAF-69
• WAF-71

Baselines

• ModSecurity 3.0.16
• Coraza 3.7.0
• OWASP CRS 4.28.0
• libinjection 4.0.0
• Zig 0.17-dev resolved and locked through Pantry

make sure stx is installed through pantry