feat: consume standalone Krad Wasm

[keys-i]

Closes #32

Motivation

Use the standalone Krad WebAssembly artifact from keys-i/krad#12 through Shell.js's existing trusted custom-command boundary, without adding a runtime dependency or third-party transpiler.

Changes

• add the exact 70-byte, import-free krad-add.wasm artifact and provenance
• expose createKradAdd() for lazy, bounded, SHA-256-verified loading
• reject invalid signed i32 input, oversized/corrupt modules, imports, and ABI mismatches
• exercise the command through Node and browser fixtures
• include the artifact in the package export and generated classic bundle

Verification

• npm run validate — PASS
• npm run build — PASS (32,433 B JS; 3,842 B shell Wasm)
• repeat build hashes — stable
• npm pack --dry-run --json — PASS; both Krad files included
• direct WebAssembly validation — zero imports; krad_add(20, 22) === 42
• source artifact SHA-256 — d6f47a8df8691ada08f49fac71b77f3b8dbb061c92041acf00988d34e25d8bcf
• BENCH_ROUNDS=250 npm run benchmark:ci — PASS
• mandatory gatekeeper unavailable (gpt-5.6 unsupported); permitted gpt-5.6-sol ultra fallback — VERDICT: PASS

Local browser execution is UNVERIFIED because no Chromium/Firefox driver starts in this environment; GitHub's browser CI must pass before merge.

Risk and rollback

The command fetches only when invoked, caps the response at 4 KiB, verifies the pinned digest, and rejects host imports. Roll back by reverting be0d711; existing shell behavior is otherwise unchanged.