Build the Rust workspace and real WebAssembly artifacts

[keys-i]

Problem

Krad currently verifies pinned Cheerp source identities but ships only JavaScript metadata. It does not build Rust packages, WebAssembly libraries, or a compiler-produced browser module.

Acceptance criteria

• replace the root implementation with a Cargo workspace containing krad-clang, krad-utils, krad-musl, and krad-libs
• preserve exact upstream source/revision/license provenance in one Rust implementation
• build checked-in release artifacts for the Rust Wasm libraries
• invoke the pinned local Cheerp distribution to compile a real C++ fixture into an ES module and WebAssembly
• verify artifact Wasm headers, exported ABI behavior, deterministic rebuilds, and failure paths
• document the exact build inputs, commands, outputs, and limits

Exclusions

• no claim of a new LLVM/Clang implementation, complete libc, full Linux/BSD distribution, or superiority over Cheerp without comparable measurements
• no network download, registry publication, release, or deployment

Risks and verification

Treat compiler binaries and source trees as trusted pinned build inputs. Reject path traversal and mismatched revisions. Run cargo fmt, clippy, tests, release builds for host and wasm32v1-none, the real Cheerp fixture build, artifact validation, and deterministic hash comparison.