WASM-inline subpath for @cipherstash/stack (Deno / Bun / Workers / Supabase Edge) #522

Tracking issue for the work delivered in #496 (merged).

What shipped

A new @cipherstash/stack/wasm-inline subpath so Protect runs in any V8-only runtime — Deno, Bun, Cloudflare Workers, Supabase Edge Functions, browsers — where the native @cipherstash/protect-ffi NAPI bindings are unavailable.

• packages/stack/src/wasm-inline.ts — Encryption() factory + WasmEncryptionClient (encrypt / decrypt round-trip) wired to WASM protect-ffi + AccessKeyStrategy from @cipherstash/auth/wasm-inline, plus schema builder re-exports (encryptedTable, encryptedColumn, …) and isEncrypted.
• ESM-only bundle — protect-ffi's wasm-inline is ESM and crashes under Node CJS require() (ERR_REQUIRE_ESM); the ./wasm-inline export deliberately omits the require branch, and tsup.config.ts builds it ESM-only. A cjs-require.test.ts guard asserts the .cjs artifact stays absent.
• cast_as normalization — normalizeCastAs() converts SDK-facing cast_as values to the EQL-native variants the WASM newClient expects (the Node entry does this internally; the WASM bindings don't). Unit-tested for drift in __tests__/wasm-inline-normalize.test.ts.
• Deno E2E smoke test (e2e/wasm/roundtrip.test.ts) — round-trips an encryption against ZeroKMS/CTS with no --allow-ffi, so a silent fallback to native bindings would fail the test loudly. New wasm-e2e-tests CI job (Deno 2.x) runs it on every PR.
• examples/supabase-worker/ — runnable Supabase Edge Function demo importing from @cipherstash/stack/wasm-inline.

Dependency bumps

• @cipherstash/protect-ffi 0.23.0 → 0.24.0
• @cipherstash/auth → 0.38.0 (for the WASM AccessKeyStrategy)

Known follow-ups

• CS_WORKSPACE_CRN parity gap — the WASM client derives workspace identity from the access-key token rather than the CRN. Tracked in WASM-inline: support CS_WORKSPACE_CRN / derive region from workspace CRN #523.
• region is currently required and will be replaced by workspaceCrn once @cipherstash/auth switches AccessKeyStrategy.create() to derive the region from a CRN.

Delivered in #496.