ci: add wasm-validate, determinism diff, cargo clippy, MSRV pin

[proofmancer]

Four lower-cost CI gates, each independently valuable.

What ships

1. wasm-validate on emitted modules

Compiler job installs wabt (apt-get install wabt), compiles each example marked "yes" in examples/README.md, runs wasm-validate on the output. Today that's just counter-mvp.cv; the list grows as more example shapes parse.

Catches: structurally invalid modules that slip past our byte-level codegen unit tests. The kind of bug that would have surfaced earlier this session if we had this gate (e.g. the OSAKA-spec REVM precompile issue, the locals-declaration off-by-one).

2. Determinism check

Compile examples/counter-mvp.cv twice in CI. cmp -s the outputs. Fail on any difference.

Catches: nondeterminism leaking in from HashMap iteration order, pointer addresses captured in output, build timestamps, locale-sensitive sorts. Cheap and high-signal.

3. cargo clippy --all-targets --release -- -D warnings

Runs as the first runtime step, before the full Wasmtime + Cranelift compile. Fail-fast for style + correctness issues.

One existing lint surfaced and is fixed in this PR: runtime/src/main.rs::hex_decode now uses s.len().is_multiple_of(2) instead of s.len() % 2 != 0 (clippy::manual_is_multiple_of warning).

4. MSRV pin

rust-version = "1.95" in runtime/Cargo.toml. Locks the floor after the v0.3 bump (revm 40 + ruint 1.18 require rustc >= 1.91). If anyone tries to downgrade, cargo's resolver complains immediately instead of failing deep inside the dependency tree.

Local verification

$ wasm-validate /tmp/ci-test.wasm   # exit 0
validate OK
$ cmp -s /tmp/det-a.wasm /tmp/det-b.wasm   # exit 0
determinism OK
$ cargo clippy --all-targets --release -- -D warnings   # exit 0
    Finished `release` profile [optimized] target(s) in 1.04s

Not in this PR (filed as their own issues)

• Release artifacts: automated cleavec + cleave-run binaries on tag push #57: release artifacts on tag push (cleavec + cleave-run binaries for Linux + macOS)
• C tooling: clang-format + clang-tidy in CI #58: clang-format + clang-tidy for the C compiler
• cargo audit on the runtime: would have been gate (5) but the Wasmtime + REVM dep tree is large and noisy; defer until someone wants to own the noise
• macOS / Windows CI runners: defer until someone hits a portability bug
• Code coverage: not worth the infrastructure at this scale