fix: harden JavaScript execution and release verification

[pepicrft]

Scope

Integrates the finalized Rust/library implementation with the CI/release hardening in this existing PR. The implementation and workflows must land together: new advisory/formatting gates correctly reject the old main baseline, and the isolated backend requires the worker executable to be included with each NIF archive.

• Upgrade to Rust 1.96 and pinned Wasmtime/WASI 49.0.3; remove javy-codegen, Wizer, and wasm-opt. Compile through the provider ABI with finite budgets.
• Bound execution, output/diagnostics, inputs/modules, cache size, and runtime admission. Validate options and preserve runtime responsiveness/cancellation while native work finishes.
• Add opt-in Linux process isolation for both compilation and execution when that runtime is selected. Ship the executable javex_worker with every packaged NIF; never silently fall back to the in-process backend.
• Reuse CI for automatic main releases, require native contract tests and coverage, scan Hex/RustSec dependencies without advisory ignores, and verify packaged NIF/helper bytes and executable mode on all four targets before publishing.
• Use Tuist Linux/macOS runners where native pools exist, retaining native hosted Intel macOS and ARM Linux fallbacks. Keep Linux's Ubuntu 22.04/glibc baseline.

Adversarial workflow fixes

• Fail closed on git-cliff errors and malformed version output; validate manual inputs and pass them through environment variables.
• Reject remote-only existing tags, lookup failures, wrong checkouts, and an advanced main before publishing; never rebase artifacts onto unverified source.
• Compile, build the Hex package, and validate docs before irreversible publication. Generate notes using the actual selected version.
• Fetch dependencies before the Hex audit. Avoid cached BEAM/NIF artifacts from older source code, scope credentials, serialize releases, and bound Cargo build concurrency.

Validation

• Passed workflow actionlint/ShellCheck, Bash syntax, and diff checks.
• Passed adversarial before/after cases for git-cliff failures/malformed output and remote-only tag collisions, plus version-selection, forced-note-version, packaging/checksum/cache, and simulated docs-failure controls.
• Integrated snapshot passes Elixir/Rust formatting, strict Credo, Hex audit, and actual RustSec audit: zero vulnerabilities and zero advisory warnings (the original baseline had 17 findings).
• All six current PR checks pass: CI and CodeQL. CI independently reports 42 ExUnit tests, zero failures, 90.08% coverage, and five passing native tests, including the Linux OS-boundary contract. Compilation and strict Clippy also pass.
• Independently repeated source compilation, Clippy, native release tests, and coverage locally after integration: 42 ExUnit tests, zero failures, 90.08% coverage, and five passing native tests.
• Built the actual NIF 2.16 archive with the executable helper and tested it in a fresh consumer with all Rust sources removed, source builds disabled, a new checksum, and an isolated cache: all 42 tests pass. Extracted NIF/helper match the built files byte-for-byte, and the helper retains executable mode.
• Production compilation with warnings as errors, mix hex.build, and mix docs --warnings-as-errors pass against the new packaged NIF. Nothing was published.
• Local runtime/package verification is Linux x86_64. The other three native target smoke tests are release gates; the release workflow has not been manually triggered.

Constraints

Isolation is opt-in and Linux-only, requiring close_range (kernel 5.9+) and seccomp TSYNC. Select the isolated runtime for both compile and run; standalone compile remains in-process. Host JSON/IPC allocations are outside the child's address-space limit. In-process limits do not create an OS security boundary.

Hex/Git/GitHub cannot form one transaction. If main advances after the final pre-publish check, the atomic Git push fails rather than rebasing, potentially after Hex has published. Main CI checks are nested under Release verification, so required-status names may need updating. No merge, release, or deployment has been requested or performed.