GeezerVison

Summary

Turn the non-JS wasm32-unknown-unknown example into a real, failure-sensitive execution harness:

• Copy supplied -c commands or UTF-8 files into guest-owned memory instead of always evaluating 1 + 3.
• Return one JSON result and meaningful process status for success, Python exceptions, invalid input, runtime traps, and host-enforced timeouts.
• Reject unexpected imports before instantiation. The guest still uses Interpreter::without_stdlib and imports only env.print, with no JS, WASI, filesystem, clock, or entropy provider.
• Replace the existing CI smoke invocation with contract tests in the same WASM job, and remove the now-unused wabt setup.
• Use an explicit fixed Python hash seed and report unsupported entropy rather than falsely reporting successful random-byte initialization.
• Require Wasmer 7.5, including its published atomic-wait bounds fix and atomic-notify bounds fix. Check valid, out-of-bounds, and unaligned atomic operations with small WAT fixtures.

This establishes the no-OS execution layer. CPython regrtest integration still needs a separate test build with explicit filesystem/stdio and other worker capabilities.

Verification

• Built the actual wasm32-unknown-unknown guest and native release Wasmer host.
• All 26 contract tests passed against the rebuilt actual guest and Wasmer 7.5 release host (146.355 seconds). They cover supplied commands/files, Unicode, empty source, 32-bit/no-OS identity, assertion/syntax/repr errors, invalid input, host-enforced timeouts and WASM instruction loops, traps, malformed ABI/results, forbidden imports, and atomic memory bounds/alignment.
• The original Rust implementation passed host/guest Clippy, repository workspace and C-API tests, and workspace/C-API Clippy. The Wasmer follow-up reran the actual guest build, native release host, all 26 contract tests, and host Clippy with --all-targets -- -D warnings.
• Changed-file pre-commit hooks, formatting, actionlint, and zizmor. Zizmor has the same four pre-existing low-severity findings as the base workflow and no new findings.

The PR is rebased onto main commit 586d38a64b (the shared WASI fix). The WASI job passed on the rebased head before this Wasmer-only follow-up; CI for the latest head is pending. No CI job, runner size, or timeout was added or increased.

AI assistance: Implemented and tested with OpenAI Codex (model identifier unavailable).