feat: support the attested verifier client in browser WASM

[soamdesai-tfh]

Enable the attested verifier client on browser WASM while preserving main's binary request/response contract, payload limits, verified result types, and input-binding checks.

• Use browser Fetch credentials, cache policy, and request deadlines while retaining native cookie/connection behavior.
• Read bounded responses through a stream API supported on native and WASM, including limits when Content-Length is absent.
• Pin the browser-compatible Pontifex source under review in fix: support attestation and channels in browser WASM pontifex#47.
• Run browser-worker tests in Flamingo's own CI, alongside the existing native checks.

Validation

Native client, protocol, and sealed-payload tests/doctests pass. All 6 browser-worker tests pass, covering binary transport, encryption, invalid attestation, stale routing, timeouts, and response type/size limits. Native/WASM Clippy, formatting, and dependency-source checks pass.

Live Nitro end-to-end matching remains unverified. This PR supports worldcoin/walletkit#548; that consumer must adapt to the updated client API when its dependency pin is advanced.

---

Note

Medium Risk
Touches attestation channel handling and HTTP transport for verifier assignment/match flows, but behavior is heavily covered by new native and browser-worker tests and preserves existing payload limits.

Overview
Adds browser WASM support for flamingo-verifier-client while keeping the same binary match contract, size limits, and verified result types.

On wasm32, HTTP setup skips native cookie/connect timeouts and instead applies Fetch include credentials, no-store cache, and per-request deadlines via configure_request. Match and error bodies are read through a stream-based bounded_response (with early rejection on bad Content-Length) so limits hold when length headers are missing on both native and WASM. Assignment verification is split into testable helpers (verify_assignment, handle_match_response).

Pontifex is bumped to 2.0.1 (with lockfile churn for wasm-bindgen-test, getrandom JS, etc.). Client tests drop Axum stub servers in favor of in-process exchange/response tests that run under tokio on native and wasm_bindgen_test in the browser; the separate tests/assignment.rs HTTP integration file is removed.

Nix default shell adds the wasm32 toolchain, wasm-bindgen-cli, Firefox/geckodriver, and the wasm test runner env; CI gains a WASM browser tests job that runs the client lib tests via nix develop.

^{Reviewed by Cursor Bugbot for commit 9fa201e. Bugbot is set up for automated code reviews on this repo. Configure here.}