fix: harden Wasmtime integration

[MuncleUscles]

Summary

• rebase the GenVM Wasmtime patch stack onto Wasmtime 43.0.2 and align wasm-tools at 1.245.0
• make the runtime feature policy explicit and shared with an independent opcode validator
• disable unauthenticated on-disk precompiled native artifacts while retaining the in-memory module cache
• restore upstream-compatible Store constructors and upstream test compatibility
• include every same-name/unnamed instance in memory fingerprints

Why

The previous integration combined an old Wasmtime pin, runtime-derived validation features, unsafe loading of mutable precompiled artifacts, a fork-wide Store API break, and fingerprint collisions when multiple instances shared a module name. In a consensus-critical executor these are security, determinism, compatibility, and observability risks.

The initial implementation targeted 42.0.2. A live advisory check identified GHSA-p8xm-42r7-89xg / RUSTSEC-2026-0114, for which no fixed 42.x release exists. This PR therefore uses 43.0.2, the closest patched line. OSV checks for both version 43.0.2 and its exact upstream commit return no published advisories.

Validation

• clean replay of all Wasmtime patches from the pinned 43.0.2 commit
• clean replay of the wasm-tools patch from 1.245.0
• cargo fmt --manifest-path executor/Cargo.toml -- --check
• full executor suite: 79 unit tests and 20 integration tests passed
• cargo test -p wasmtime --tests: complete upstream Wasmtime test suite passed (158 tests passed, 1 ignored)
• new deterministic-opcode and duplicate-instance fingerprint regressions passed

Review notes

The on-disk precompile command now fails closed until artifacts have immutable, authenticated provenance. The in-memory compiled-module cache remains enabled.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4034eec6-86f6-47be-baca-a165830aa594

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kp2pml30]

shared with an independent opcode validator

I disagree on rejecting wasm files for having a forbidden instruction. Changes I agree with were ported into genlayerlabs/genvm-manager#34