chore: sort out pending fixes and build/CI plumbing

.git-third-party/.gitattributes

@@ -0,0 +1,6 @@
+# Managed by git-third-party.
+
+# Patch names are a digest of the patch bytes: normalizing them changes what
+# gets applied, and breaks the name.
+patches/** -text
+manifest.json text eol=lf

.git-third-party/.gitignore

@@ -0,0 +1,5 @@
+# Managed by git-third-party.
+
+# Scratch left behind by an interrupted write.
+*.tmp
+patches/**/*.tmp

.git-third-party/manifest.json

@@ -0,0 +1,23 @@
+{
+	"repos": {
+		"executor/third-party/wasmtime": {
+			"url": "https://github.com/bytecodealliance/wasmtime.git",
+			"commit": "7bac2c2775808aaec5d4aa5627a5e447b51102cf",
+			"patches": [
+				"gbm0xv16dc1fs2km",
+				"zsjxmza3dms0hr10",
+				"4rr93pqjtwm5m701",
+				"r6518c8dxghpkhsj",
+				"6xy06vg0d71czwmm"
+			],
+			"submodules": []
+		},
+		"executor/third-party/wasm-tools": {
+			"url": "https://github.com/bytecodealliance/wasm-tools.git",
+			"commit": "bb58fdf919912e05c976a0b71aaa843f7d1938f9",
+			"patches": [
+				"n359mz2sdabr2wsa"
+			]
+		}
+	}
+}

.git-third-party/patches/executor/third-party/wasm-tools/1 → .git-third-party/patches/executor/third-party/wasm-tools/n359mz2sdabr2wsa

@@ -9,10 +9,10 @@ Subject: [PATCH] fix: expose method for fuzzing
  2 files changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/crates/wasm-smith/src/core.rs b/crates/wasm-smith/src/core.rs
-index e37ab57..502262b 100644
+index b59fd588..ced65860 100644
 --- a/crates/wasm-smith/src/core.rs
 +++ b/crates/wasm-smith/src/core.rs
-@@ -2573,7 +2573,7 @@ impl Module {
+@@ -2796,7 +2796,7 @@ impl Module {
                  // allow encoding any other type in that form.
                  let can_use_function_list = ty == RefType::FUNCREF;
                  if !self.config.reference_types_enabled {
@@ -22,7 +22,7 @@ index e37ab57..502262b 100644
 
                  // If a function list is possible then build up a list of
 diff --git a/crates/wasm-smith/src/core/encode.rs b/crates/wasm-smith/src/core/encode.rs
-index d2ffd48..5b9b551 100644
+index d2ffd488..5b9b5514 100644
 --- a/crates/wasm-smith/src/core/encode.rs
 +++ b/crates/wasm-smith/src/core/encode.rs
 @@ -6,7 +6,8 @@ impl Module {

.git-third-party/patches/executor/third-party/wasmtime/3 → .git-third-party/patches/executor/third-party/wasmtime/4rr93pqjtwm5m701

@@ -11,17 +11,15 @@ f32x4/f64x2 splat, extract_lane and replace_lane are bit-exact copies
 (no rounding or NaN semantics), matching the existing exception for
 loads/bitcasts; genvm-floats-to-soft intentionally leaves them in
 place, so trapping on them broke real numpy code paths.
-
-Claude-Session: https://claude.ai/code/session_013QtkVNJFxWsNwCLhTp5idV
 ---
  crates/cranelift/src/translate/code_translator.rs | 7 ++++---
  1 file changed, 4 insertions(+), 3 deletions(-)
 
 diff --git a/crates/cranelift/src/translate/code_translator.rs b/crates/cranelift/src/translate/code_translator.rs
-index 9dde783c..927df0f8 100644
+index 5c33b47..0a02c4d 100644
 --- a/crates/cranelift/src/translate/code_translator.rs
 +++ b/crates/cranelift/src/translate/code_translator.rs
-@@ -1750,7 +1750,8 @@ pub fn translate_operator(
+@@ -1804,7 +1804,8 @@ pub fn translate_operator(
          }
          Operator::F32x4Splat
          | Operator::F64x2Splat => {
@@ -31,7 +29,7 @@ index 9dde783c..927df0f8 100644
              let splatted = builder.ins().splat(type_of(op), environ.stacks.pop1());
              environ.stacks.push1(splatted)
          }
-@@ -1839,7 +1840,7 @@ pub fn translate_operator(
+@@ -1893,7 +1894,7 @@ pub fn translate_operator(
          }
          Operator::F32x4ExtractLane { lane }
          | Operator::F64x2ExtractLane { lane } => {
@@ -40,7 +38,7 @@ index 9dde783c..927df0f8 100644
              let vector = pop1_with_bitcast(environ, type_of(op), builder);
              environ
                  .stacks
-@@ -1864,7 +1865,7 @@ pub fn translate_operator(
+@@ -1918,7 +1919,7 @@ pub fn translate_operator(
          }
          Operator::F32x4ReplaceLane { lane }
          | Operator::F64x2ReplaceLane { lane } => {