feat: add sandboxed WASM plugin runtime (#35)

[nomsoscript]

Summary

• Adds a wasmi-backed sandboxed WASM plugin runtime with ABI validation and import permission checks.
• Extends plugin manifests, registry lookup, install/load/audit/execute flows to support .wasm plugin artifacts.
• Adds SDK ABI export support plus tests for WASM ABI compatibility and sandbox boundary enforcement.

Closes #35

Testing

• cargo check --message-format=short
• cargo test plugins::wasm_runtime --lib -- --nocapture
• cargo test --lib