feat: add Wasmtime executor and modular VM packages

[NathanFlurry]

• Add a selectable Wasmtime WASM executor and modular VM/kernel runtime, with V8 remaining the default engine.
• Reconcile the refactor with current main's actor/client contracts, filesystem behavior, and POSIX process and socket semantics.
• Restore test-backed VM boundaries and compatibility across trusted startup, TCP/UDP isolation, explicit network grants, fd replies, async file cancellation, and the event pump.
• Document release-binary performance and memory results, including the cold-start and admission gates for changing the default.