Release standard: add witness + scry wasm gates, crates.io/npm, rivet verification extraction #302

Sweep finding: meld fuses wasm in/out but runs no wasm-level verification and has 0 rivet verifies links (traceability lives in safety/requirements/traceability.yaml, ~20 refs, not in the rivet graph). Track A is fully signed.

Track C — wasm gates (priority):

• Add a witness MC/DC gate on fused components.
• Add a scry abstract-interpretation gate.
• sigil-sign the fused wasm — blocked on friction: wsc can't sign its own wasm32-wasip2 output — blocks org-wide sigil-sign-wasm standard sigil#164 ; cosign now.

Track B — distribution: GH-Release-only.

• Publish to crates.io; add npm wrapper if meld-cli is user-facing.

Track E — rivet extraction: migrate the traceability.yaml refs into typed rivet verifies links + an executable gate (relay is the test-level exemplar). The existing LS-regression verification-gate.yml is a good base.

Part of the org-wide release-consistency campaign — the five-track standard is in the release-artifact-pipeline skill (plugin v0.10.0).
Coordination hub: pulseengine/pulseengine.eu#98 — if this standard does not fit this repo (you need a deviation, different sequencing, or want to sync on how a track applies), raise it there. Deviations are decided in the open at the hub, not diverged silently.