Release standard: add witness + scry CI gates on the falcon wasm

[avrabe]

Sweep finding: jess builds wasm firmware (falcon-* via rules_wasm_component) and gates CI on rivet + spar, but runs neither witness nor scry on the wasm it produces. jess is CI-only (no artifact release), so this is about CI gates, not a release pipeline.

Track C — wasm gates (priority):

• Add a witness MC/DC gate in ci.yml on the falcon wasm.
• Add a scry abstract-interpretation gate (consume scry as a crates.io lib).
• If/when jess ships any wasm artifact, sigil-sign it — blocked on friction: wsc can't sign its own wasm32-wasip2 output — blocks org-wide sigil-sign-wasm standard sigil#164.

Tracks A/B/D N/A while jess doesn't cut releases — revisit if that changes.

---

Part of the org-wide release-consistency campaign — the five-track standard is in the release-artifact-pipeline skill (plugin v0.10.0).
Coordination hub: pulseengine/pulseengine.eu#98 — if this standard does not fit this repo (you need a deviation, different sequencing, or want to sync on how a track applies), raise it there. Deviations are decided in the open at the hub, not diverged silently.

[avrabe]

[jess — triaged + feasibility confirmed; one deviation flagged at the hub]

Valid and aligned (it's the right side of the V that pulseengine.eu#90 flagged from jess). Investigated locally, captured as REQ-PIX-018 (PR #96):

witness — feasible on the artifact jess already produces. witness instruments core modules, not the falcon component — but scripts/jess-build.sh already meld-fuses to a core (falcon.fused.wasm). witness instrument falcon.fused.wasm (v0.36.0, SHA/sig-verified darwin) → 1407 branches, 0 DWARF-correlated decisions. The released falcon wasm is stripped (only a name section, no .debug_*), so jess gets structural branch coverage, not DWARF-correlated MC/DC. Running the instrumented core needs a harness — jess-build.sh already drives the fused core under kilnd, so that's in reach.

scry — feasible. Ships scry-1.17.0-wasm32-wasip2.wasm + a crates.io lib (synth-cli already consumes it for the #383 shadow-stack analysis); runnable on the fused core.

One deviation, raised at the hub (pulseengine.eu#98) per "deviations are decided in the open": jess consumes the released stripped falcon wasm rather than building it with debuginfo, so its witness gate is branch-coverage + scry sound-analysis on the fused core — complementing relay's source-level DWARF-MC/DC, not duplicating it. If the standard wants DWARF-correlated MC/DC in jess too, that needs jess to build falcon-from-source with debuginfo (a bigger change) — flagging the choice rather than diverging silently. sigil track stays N/A (jess cuts no release; sigil#164).

Plan: wire (a) a witness branch-coverage gate (meld fuse → instrument → run via kilnd → report → no-regression) and (b) a scry sound-analysis gate into ci.yml, both on the fused core. That's the deliberate follow-on — I didn't rush two safety gates into a 4h supervisory tick. Will do it as a focused feature next; tracking on REQ-PIX-018.