release.yml pins cargo install wasm-pack --version 0.14.0 --locked for the published WASM. Local dev builds were observed using wasm-pack 0.13.1 during the PR #44 work. wasm-pack 0.13.x vs 0.14.x can emit different wasm-bindgen JS glue.

Risk is low: the golden-vector byte-identity gate verifies the encoded output bytes, which are produced by the Rust codec, not the wasm-bindgen JS wrapper — and the suite is green under both versions. So this is cosmetic / reproducibility hygiene, not a byte-identity risk.

Action: document the required local wasm-pack version (0.14.0) in CONTRIBUTING, and/or add a version check to the build script so local builds match CI.

Surfaced by: PR #44 (Iris review, P2).