feat: build standalone Rust and LLVM WebAssembly artifacts

[keys-i]

Motivation

Replace the proposed compiler-specific source/archive/runtime stack with an independently buildable Rust and standard LLVM WebAssembly workspace.

Changes

• Add krad-clang, krad-musl, krad-libs, and krad-utils Rust crates.
• Build four wasm32v1-none modules and one real C++ fixture with an explicit standard LLVM/Clang compiler.
• Validate complete Wasm modules, reject imports, and require the expected function exports.
• Publish marker-owned artifact directories as one recoverable set under an OS file lock.
• Check in and execute-test all five raw Wasm artifacts.
• Add pinned, least-privilege CI that SHA-verifies WASI SDK 33 and byte-compares rebuilt artifacts.
• Add MIT license and package metadata.

The repository, build flags, dependencies, and generated artifacts contain no dependency on the rejected compiler stack.

Verification

• cargo fmt --all -- --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace — 8 passed
• cargo build --locked --workspace --release
• cargo build --locked --release --target wasm32v1-none --workspace --lib
• Two builds with SHA-verified WASI SDK 33 / Clang 22.1 were byte-identical to each other and the five committed artifacts.
• All five Wasm modules have zero imports and execute their expected exports.
• Eight simultaneous CLI builds completed successfully and produced one exact artifact set.
• Regular files, unmarked directories, symlink markers, and unmanaged sidecars are rejected and preserved; missing-output and post-publish recovery paths pass.
• Repository source, binary contents, and filename exclusion scans pass.

Risks and rollback

The public boundary is intentionally limited to the four crates, the krad build command, and five version-1 Wasm exports. Revert the four commits in this PR to return bootstrap to its empty initialization state.

Closes #11