INT-03 S2: provision component-model toolchain (wasm-tools, wasm-component-ld, wac) #251

Per ADR-015 (WASI Preview2 / WASM Component-Model migration, owner-chosen full re-target), slices S3..S6 are HARD-GATED on this.

The component-model toolchain is absent from the current environment: only wasmtime (44.0.1) is present. A WASM component cannot be built or tested without:

• wasm-tools (component encode/validate, wasm-tools component new)
• wasm-component-ld (or wac) for linking the preview1→preview2 adapter
• the standard wasi_snapshot_preview1 reactor/command adapter .wasm

Work

1. Add the above to guix.scm (primary) + flake.nix (fallback), SHA-pinned per repo security policy.
2. Vendor or fetch-pin the official wasi_snapshot_preview1 adapter; record provenance + checksum.
3. CI: make the component toolchain available to the wasm-target job.

Blocks: ADR-015 S3 (componentize on-ramp) and everything after. Refs #180.