fix(bazel): //:falcon-cascade has not built since #393 — wire falcon-core

[avrabe]

Verify-Filter: (or (has-tag "verification-gate") (has-tag "wasm"))

Closes #397. Refs #407.

What was broken

#393 rewrote the cascade component to wrap falcon_core::FlightCore instead of
composing five stage interfaces. The cargo build was updated. The bazel
target was not, and still carried the comment from when it was true:

# No control-crate dep: the cascade is pure orchestration.
rust_wasm_component_bindgen(name = "falcon-cascade", ...)   # no deps at all

unresolved import falcon_core on every main commit since 2026-09-11 — red, and
blocking nothing, because Bazel is not a required context.

The repair

12 new rust_library targets (falcon-core's closure is 15 crates;
relay-math, relay-iekf and relay-mix-quad already had one). Their deps are
generated from each crate's Cargo.toml rather than hand-listed — a bazel
dep set that drifts from the cargo one is precisely the defect class this target
is being repaired for, and hand-maintaining twelve of them is how it happens
again.

embedded-io + embedded-io-async were the only out-of-repo dependency in
the closure and were not in the bazel crate universe (the only @crates// label
anywhere in BUILD.bazel is wit-bindgen). Both are pure no_std with no build
script, so they get the same http_archive treatment as libm, with the
Cargo.lock checksums as sha256.

Both also needed compile_data = ["README.md"] — their lib.rs does
#![doc = include_str!("../README.md")], so without the README in the sandbox
they do not compile at all.

Verified

• bazel build //:falcon-cascade — succeeds
• bazel build //:falcon-cascade-fused — fuses
• all 19 targets bazel.yml builds — succeed

A correction to #397, which I overclaimed

The issue said this breakage also stopped the cascade's witness MC/DC
coverage being produced, and called that the real loss. That was wrong:

$ grep -rn 'falcon-cascade-coverage' .github/workflows/
(no output)

//:falcon-cascade-coverage is tags = ["manual"] and is in no workflow,
so CI has never built it — before #393 or after. The regression was narrower
than claimed; the coverage gap is older and separate, now #407.

The same correction is applied inside SWREQ-RELAY-VGATE-P04, as a correction
rather than a silent edit — attributing a long-standing absence to the most
recent change is exactly the failure that requirement exists to prevent.

Uncovered one layer down

With the build fixed, the coverage target now reaches the fuse and fails
differently — duplicate export name cabi_realloc$2 — filed as #407 rather than
folded in here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HvusAXYbHLyv3uTzfBcMbG