Wasm decoder: reject hostile declarations before pathological allocation

[chrisbbreuer]

CI root: https://github.com/zig-utils/zig-js/actions/runs/29693769324/job/88210905218
Related: #141, #260, #305
Roadmap: #142, #268, #134

Root cause and implementation

Two deterministic decoder witnesses failed in Linux normal and TSan shards:

• an externref table import decoded while reference-types was disabled;
• two maximal local declaration groups attempted to allocate the first 0xffffffff locals and returned OutOfMemory before the decoder could report the deterministic "too many locals" malformed diagnostic.

Commit 9f0b639f preserves MVP funcref tables while gating externref table elements on reference-types. Function locals now use a two-phase parse: retain only bounded declaration records, reject a total above u32, then allocate and expand the final local vector exactly once. Error paths release both declaration and expanded storage.

Acceptance

• Gate externref table element types on reference-types while preserving MVP funcref tables.
• Parse and bound all local groups before expanding them into the function-local vector.
• Keep malformed decoding failure-atomic and leak-free on every error path.
• Preserve exact diagnostic offsets/messages.
• Pass focused normal malformed decoder tests: 8/8, zero leaks.
• Pass Linux normal/TSan replacement CI.

[chrisbbreuer]

Replacement run 29697559754 has all four Linux normal unit shards green on 7650986f. The matching TSan unit shards are still running; this issue remains open until that half of the gate completes.

[chrisbbreuer]

Replacement run 29697559754 has all normal unit shards green and the decoder-bearing TSan shards 1/2 green on 7650986f. The hostile declarations now fail deterministically without pathological allocation or leaks.