Harden validation, cleanup, and release asset checks

[LunaStev]

Summary

Protect FreeBSD validation inputs from report writes, restrict x.py clean to repository-owned outputs, require complete release checksum coverage, and apply selected runtime cases' stdin and expected-exit metadata.

• Reject report destinations that alias VM images, firmware, kernels, compiler/tools, case sources, or std files, including symlinks and hardlinks. Preserve failure and interruption reports through atomic writes.
• Resolve cleanup paths from the repository root and remove only recognized Wave package names and checksum sidecars. Preserve unrelated archives and .tmp/.
• Validate the exact eight-archive release inventory and one matching checksum record per archive before atomically generating SHA256SUMS.
• Separate WASM compilation, execution planning, and runtime results so compilation failures cannot satisfy a program's expected nonzero exit. Reuse the compiler's existing host command, forward stdin, use the selected QEMU sysroot for compilation and execution, and preserve WASI proc_exit status in the Node runner.

Motivation

The existing tools could overwrite validation inputs, clean files relative to the caller's directory, accept incomplete checksum coverage, or misreport runtime results by ignoring case metadata.

Closes #821
Closes #822
Closes #820
Closes #819

Part of #832. The tools/ci/ migration and rolling Nightly work remain separate follow-ups.

Target and compatibility impact

Changes affect FreeBSD validation tooling, repository cleanup, release publication gates, QEMU case execution, and WebAssembly host execution. WASI explicit process exits now reach the host exit status. Invalid report destinations and release checksum records receive explicit errors.

No language or C ABI changes. Case selection, #459 runtime classification, and the separate WASM host-function dependency failures remain unchanged; this PR adds no host shims or exclusions.

Validation

• python3 -m unittest tools.test_freebsd_runtime_reporting tools.test_x tools.test_release_publish tools.test_runtime_cases — 36 passed.
• python3 -m unittest tools.test_runtime_cases — 15 passed after the final sysroot path adjustment.
• PATH=/usr/lib64/llvm21/bin:$PATH LLVM_SYS_211_PREFIX=/usr/lib64/llvm21 cargo +1.89 test --jobs 2 --test codegen_regressions wasi_runner_preserves_explicit_process_exit_status — passed; verifies WASI explicit exits 0 and 7.
• Actual builds and execution with the source-built compiler and checkout std: wasm32-unknown and wasm64-unknown returned the expected 7; WASI and AArch64 QEMU consumed 3\n and exited 7. The QEMU probe used a temporary AArch64 target configuration and local sysroot without changing the manifest.
• PATH=/usr/lib64/llvm21/bin:$PATH LLVM_SYS_211_PREFIX=/usr/lib64/llvm21 cargo +1.89 clippy --jobs 2 --bin wavec --test codegen_regressions -- -D warnings — passed.
• cargo +1.89 fmt --all -- --check and git diff --check — passed.

FreeBSD report failure/alias behavior was covered locally without booting a VM. Native Windows, macOS, and FreeBSD execution remains for CI. Cleanup and checksum regression tests are included in the existing Python CI steps.

Checklist

• Commits include a DCO Signed-off-by line.
• Tests cover new behavior or the PR explains why no test is needed.
• User-facing changes include documentation or diagnostics updates.
• The change preserves the license boundary between the compiler and std/.