feat(wasm): add signed reboot-free module updates

[ajlennon]

Summary

• Pin WAMR 2.4.3 and prove the exact MIMXRT1170-EVK ARM ELF in Renode with a deliberately narrow aesl_label_set host capability.
• Add independently signed P-256/SHA-256 WASM packages, plus a reboot-free Mender wasm-module Update Module with bounded streaming, monotonic versions, atomic A/B activation, rollback and boot recovery.
• Add reproducible native_sim, Renode and RT1170 product build profiles, artifact tooling, security-boundary documentation, and fast hosted CI for the maintained WAMR/Mender contract and package failure paths.
• Move JavaScript Actions used by the edited workflow to their Node 24 generations.

Test plan

• Exact RT1170 ARM ELF: ./scripts/build-wamr-rt1170.sh and ./scripts/test-wamr-renode.sh
• Product lifecycle: ./scripts/test-native-sim-wamr.sh - v7 to v8, downgrade denied, rollback to v7, corrupt-active recovery to v7, no reboot
• Full MCUboot + Mender + e-ink + WAMR RT1170 product build and .mender generation
• Artifact inspection: type wasm-module, compatible type mimxrt1170_evk, provide rootfs.wasm-module.version: 8
• python3 scripts/check-wasm-contract.py
• PAYLOAD=/nonexistent/ci-fallback.wasm ./scripts/test-wasm-package.sh
• ShellCheck and whitespace checks
• Physical MIMXRT1170-EVK and custom-board validation with production signing keys, CAAM entropy, Hosted Mender deployment, power-loss injection and peak-heap measurement

The simulator proof deliberately uses deterministic test entropy. Production hardware builds retain CAAM support. The activation-state CRC protects against corruption, not an attacker with arbitrary flash-write access; secure anti-rollback needs an EdgeLock/OTP-backed version floor.

Assisted-by: Codex (OpenAI)