refactor(manifest): type chain-log filters and gated WASI names

[mfw78]

What

Types the two manifest values that stayed stringly-typed past parse time.

Subscription::ChainLog and its serde twin CoreSubscription now carry Option<Address> and Option<B256> instead of raw hex strings, parsed in manifest/load.rs at manifest load.

build_alloy_filter and chainlog_cursor_key take the typed values directly, so their parse-and-FilterError arms are gone and a malformed chain-log address or topic refuses the boot as a manifest error before any compile, not at first log-poller dispatch.

The two gated WASI capability names are now a single enum WasiCap { Sockets, Filesystem } with as_str() and an ALL const.

WASI_CAPABILITIES derives from WasiCap::ALL, and WasiGate::Gated carries a WasiCap instead of an arbitrary &'static str.

Why

Closes #28

Two manifest values were parsed twice: once implicitly by the manifest loader accepting any string, and once for real inside the supervisor when a subscription first opened.

That let a malformed address or topic hex sit in a validated manifest and fail only at first dispatch, not at boot.

The gated-WASI name set was duplicated across the WASI_CAPABILITIES array and the classify_wasi match arms, so adding a namespace meant editing two unlinked sites with no compiler check that they agreed.

Testing

cargo nextest run -p nexum-runtime: 434 tests run, 434 passed, 0 skipped.

cargo clippy -p nexum-runtime --all-targets: clean.

chainlog_cursor_key_matches_the_legacy_string_derivation pins the typed derivation to the same key a pre-typing resume cursor would have written, so an in-flight cursor survives the upgrade.

boot_refuses_an_invalid_chain_log_filter asserts the refusal now happens during manifest parse (load module / manifest: parse), before component read or compile, with the pinned operator wording for a bad address and a bad topic.

AI Assistance

Claude (Fable 5) used for implementation, Claude Opus 4.5 used for red-team review, Claude Sonnet 5 used for the PR.