feat: add wasm browser workload contracts

[intel352]

Summary

• add public compute-core payload contracts for WASM component, provider-backed WASM, and product-capture browser workloads
• preserve existing workflow-compute validation behavior for scoped component refs, digest-pinned image/component refs, provider/component identity binding, bounded product capture limits, and JSON object/array inputs
• unblock RTE-2 so workflow-plugin-compute-wasm can avoid copying workflow-compute structs

Verification

• PASS: GOWORK=off go test ./protocol -run 'TestWASMRuntimePayloadContracts|TestProductCaptureWorkloadValidation' -count=1
• PASS: GOWORK=off go test ./... -count=1
• PASS: GOWORK=off go vet ./...
• PASS: git diff --check

Adversarial review

Self-review checked for host authority leaks and validation loosening. This only adds data contracts and validators; no worker credentials, authz, artifact store paths, proof mutation, or settlement authority move into compute-core.

Generated by the implementing agent.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.