Release standard: add witness + scry wasm gates, crates.io/npm, rivet verification extraction

[avrabe]

Sweep finding: loom is the dedicated wasm optimizer yet runs no wasm-level verification — Track A (native binary) is fully signed, but the wasm it produces/optimizes gets no MC/DC and no abstract interpretation.

Track C — wasm gates (priority):

• Add a witness MC/DC gate in CI on representative optimized wasm (assert zero unresolved gap rows for new decisions).
• Add a scry abstract-interpretation gate (consume scry as a crates.io lib, v1.15+).
• sigil-sign the wasm — blocked on friction: wsc can't sign its own wasm32-wasip2 output — blocks org-wide sigil-sign-wasm standard sigil#164 (wasip2 parser); add cosign now, sigil as it clears.

Track B — distribution: loom is GH-Release-only.

• Publish to crates.io (signed CI, OIDC).
• If loom-cli is user-facing, add the npm wrapper.

Track E — rivet extraction: ~6 verifies links today. Adopt relay's test-level pattern + the run_verification.py gate (loom already has verification-gate.yml — extend it).

---

Part of the org-wide release-consistency campaign — the five-track standard is in the release-artifact-pipeline skill (plugin v0.10.0).
Coordination hub: pulseengine/pulseengine.eu#98 — if this standard does not fit this repo (you need a deviation, different sequencing, or want to sync on how a track applies), raise it there. Deviations are decided in the open at the hub, not diverged silently.