build: add wasm targets for policy module and WASI linter

[starkross]

Adds two make targets. Both were run and verified locally (go1.26.1, opa 1.17.0, macOS arm64).

make wasm-policy → dist/wasm/policy.wasm (192K)

Compiles the Rego rules to a standalone wasm module using OPA's Rego→wasm compiler. Policies only — no interpreter, no Go runtime — so any OPA-ABI host (JS, Rust, Python, Go, …) can evaluate them.

Verified by loading the built artifact with @open-policy-agent/opa-wasm and evaluating testdata/bad.yaml: identical 6 findings (OTEL-001, 003, 010, 011, 015, 033) to the native binary, same rule IDs and messages.

load+instantiate  16.2 ms
first eval         2.78 ms
steady-state       0.057 ms

make wasm → dist/wasm/augur.wasm (44M)

The whole linter — CLI, YAML loading, env expansion, embedded OPA interpreter — as a WASI preview 1 module, runnable under wasmtime, wasmer or node. --format json output is byte-identical to the native binary. Large but self-contained; fine for server or CI embedding, too heavy for a browser.

Why both

The size gap is the interesting part and the reason the targets are named separately rather than one wasm:

build	raw	brotli
policy.wasm	195,435	54 KB
augur.wasm (wasip1)	46,593,356	6.04 MB
Go hello-world (runtime floor)	1,646,290	371 KB

Stripping the entire CLI and cobra from the wasip1 build saved 1.6M of 46.6M — the bundled OPA interpreter is ~96% of it, and TinyGo can't compile OPA (reflection). So the two artifacts aren't small-and-large versions of one thing; they're for different consumers, and policy.wasm is the only viable browser payload.

Notes

• Both write to dist/wasm/, already covered by .gitignore and already removed by make clean (verified).
• wasm-policy guards on opa being installed, matching the existing conftest/regal idiom.
• --ignore '*_test.rego' matters: without it opa build sweeps the ~90 test rules in as entrypoints, inflating the module to 261K.
• No CI wiring here — happy to add a job that builds and size-checks these if you want it.