Align Wave artifacts and harden release acceptance

[LunaStev]

Summary

Fix Wave compiler artifact selection for Windows MSVC and Linux LoongArch64, require explicit package execution verification, and prevent closed CLI output pipes from causing Rust panics. Strengthen lockfile regression coverage and update release readiness documentation.

Why

Vex still selected a retired Windows GNU compiler archive and rejected two Wave distribution hosts. Packaging could report success after skipping execution verification, and Vex-owned stdout could panic when a pipe consumer exited early.

Behavior

• Select all eight Wave distribution targets, including both Windows MSVC ZIPs and Linux LoongArch64. Reject missing assets without GNU fallback; preserve checksum/provenance, safe extraction, version validation and atomic installation. Fake archives cover preserved std/runtime layout and previous-installation preservation.
• Require package version/help execution by default. Only x.py package --allow-unverified permits an absent verifier for development; it never suppresses a failing smoke test and is unavailable to x.py release. Emit a digest-bound JSON verification record per packaged archive.
• Use fallible Vex-owned stdout writes. Broken pipes stop further writes without changing the command outcome; other stdout errors are environment errors. Keep inherited program stdio and exit codes, and preserve separate JSONL message reporting.
• Extend real SHA-256 Git fixtures to v2/v3 migration and offline reuse with an unavailable remote; verify canonical path diamonds across nesting/order and unchanged unrelated pins/refs during transitive replacement/removal.
• Document Wave's additive metadata schema and current release acceptance. This does not activate real-compiler CI before the official compatible Wave release, expand Vex's distribution targets, or create a release/tag.

Validation

• cargo fmt --check
• cargo test --workspace --locked — 135 passed; one ignored subprocess helper is exercised by its parent tests.
• cargo clippy --workspace --locked --all-targets -- -D warnings
• cargo build --workspace --locked
• python3 x.py check passed with installed wavec removed from PATH, VEX_WAVEC unset and an empty managed-toolchain directory; Python suite: 32 passed. Local TCP synchronization fixtures required execution outside the restricted sandbox.
• cargo check --workspace --tests --locked --target x86_64-pc-windows-gnu passed (cross-compile only, not native Windows execution).
• Linux amd64 release build/package passed actual version/help execution. SHA256SUMS and the JSON verification report match the archive digest.
• Native Windows/macOS CI remains PR validation. Official Wave v0.2.1-pre-beta artifact verification and required compiler CI remain follow-up work in Run end-to-end CI against a pinned real wavec #66/Exercise public Wave package re-exports through Vex in compatibility CI #131.

Issues

Closes #154
Closes #71
Closes #91
Closes #138
Closes #110
Closes #124

Related acceptance/tracking: #96, #79, #75, #99, #146, #147, #148. Official-release-dependent follow-up: #66, #131. These broader issues are not automatically closed by this PR.

Checklist

• The change is focused and targets wavefnd/Vex:master.
• User-facing behavior and recovery instructions are documented.
• Dependency changes preserve lockfile reproducibility (Cargo dependencies unchanged).
• --locked and --offline behavior remains correct.
• No raw wavec flags were added to the Vex CLI.
• New commits include a DCO Signed-off-by: line.