feat(release): publish sysml-wasm as release assets and an npm package

[devin-ai-integration]

What and why

Publishes the combined sysml-wasm module, so callers of connectWasm() no longer have to build it from source.

Stacked: this PR is based on #872 (#870 is already on develop). Merge #872 first. I'll then retarget this PR to develop.

• Build: a new make build-release-wasm target builds bin/wasm/release/sysml-wasm.wasm (js/wasm, -trimpath, release ldflags) and copies wasm_exec.js from the same Go toolchain.
• Stable release (CircleCI):
  • build-release-binaries builds the module into dist/wasm/ and checks that it carries the tag.
  • build-release adds both files to SHA256SUMS.txt, writes their .sha256 sidecars, and adds wasm/sysml-wasm.wasm to the provenance check. The cosign signature and the SLSA provenance therefore cover both files.
  • publish-github-release uploads both files and their sidecars.
• Nightly: scripts/build-release-artifacts.sh builds the same files, adds them to the manifest and writes the sidecars, and nightly.yml uploads them. The nightly manifest is still cosign-signed. Nightly snapshots still have no SLSA provenance, and the docs say so.
• npm:
  • build-platform-packages.mjs --wasm <dir> also builds @openmbee/opensysml-wasm, which contains sysml-wasm.wasm, wasm_exec.js and a README. Each file is checked against its sidecar.
  • publish-npm publishes it with the platform packages, before the client, and now expects seven packages.
  • The client lists it as an optional peer dependency pinned to the client's version. A test keeps the two versions in lockstep, and the check_version.py hint mentions the peer.
• Node: connectWasm() with no wasm option resolves the module and runtime from the installed @openmbee/opensysml-wasm. If the package is missing, the error names the package and version to install. Passing wasm without wasmExec is now an error, because a runtime from a different toolchain can't be guessed.
• Browser: there is no automatic resolution. The README shows the bundler form (new URL("@openmbee/opensysml-wasm/sysml-wasm.wasm", import.meta.url)) and the jsDelivr URLs.
• Docs:
  • docs/reference/wasm.md no longer says that no WebAssembly artifact ships.
  • docs/project/releasing.md covers the assets and the seven npm packages.
  • docs/project/nightly.md lists the new assets.
  • client/node/README.md covers Node installation and automatic resolution, plus the browser bundler and CDN forms.

How it was verified

• client/node: build, typecheck, lint and test all pass (389 passed, 0 skipped, before feat(node): connect the client to the combined sysml-wasm module #872's later review fixes were merged in). New tests cover:
  • building the WASM package, and refusing a mismatched or missing sidecar
  • the peer dependency's name and version
  • package resolution and its errors
  • the WASM differential run through a fake installed package
• client/python: tests/test_check_version.py passes (80 tests).
• VERSION=v0.0.0-test scripts/build-release-artifacts.sh ran end to end. dist/wasm holds both files and their sidecars, SHA256SUMS.txt lists them, and sha256sum -c passes.
• Packages were built from that output, and the WASM package was dry-run packed: 7.9 MB packed, 31.6 MB unpacked. With the packed client and WASM tarballs installed in a fresh project, connectWasm() with no options evaluated 2 + 2 to 4.
• Both workflow YAML files parse, and make docs-check and the changelog check pass.
• CI is green on the current head, which includes feat(node): connect the client to the combined sysml-wasm module #872's latest fixes.
• The CircleCI release jobs only run on tags, so those steps weren't run end to end. They mirror the nightly script, which was run.

Checklist

• make test and make lint pass locally (client and release-script gates run; full Go suite left to CI)
• Tests added or updated for the change
• Documentation extended where it already covers the surface (see CONTRIBUTING.md)
• Changelog entry added as changes/unreleased/<slug>.<section>.md, not as an edit to CHANGELOG.md
• baselines regenerated and make docs-counts run if a gate count moved (no gate count moved)
• No internal work-item labels (waves, slices, F4, K5) in the body, docs, or changelog

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring