feat: export wasm flake artifacts and demo apps

[paolino]

Summary

This follow-up makes the WebAssembly surface exported by the flake match the actual artifacts we ship.

Before this branch, packages.csmt-verify-wasm was misleading: it exposed the full four-module WASM output directory, not the single csmt-verify.wasm binary its name suggested. The repository also had no nix run entrypoints for serving the static demo bundles locally.

This branch fixes that by exporting:

• packages.wasm-artifacts for the combined WASM output directory
• one package per raw module:
  • packages.csmt-verify-wasm
  • packages.csmt-write-wasm
  • packages.mpf-verify-wasm
  • packages.mpf-write-wasm
• runnable apps for the static bundles:
  • apps.csmt-verify-wasm-demo
  • apps.csmt-wasm-write-demo
  • apps.mpf-wasm-write-demo
  • apps.docs

What Changed

Flake packaging

• extracted the WASM packaging logic into nix/wasm-packages.nix
• added thin per-module derivations that copy a single .wasm file out of the combined mts-wasm build output
• kept the full bundle available as wasm-artifacts so downstream consumers can still fetch all four modules at once
• exposed the static demo bundles and docs site as flake apps backed by a simple local Python HTTP server

Documentation

• updated README.md with the new nix build and nix run entrypoints
• updated docs/installation.md so the install/tutorial path includes the exported WASM outputs and preview commands
• corrected the CSMT and MPF demo pages so their “build it yourself” sections point at the raw module packages (csmt-write-wasm, mpf-write-wasm, etc.) instead of implying the demo bundle package is the module itself
• documented the new local preview commands directly on the demo pages

Reviewer Notes

The main thing to check is naming parity:

• nix build .#csmt-verify-wasm now yields only csmt-verify.wasm
• nix build .#wasm-artifacts yields the combined directory with all four modules
• nix run .#mpf-wasm-write-demo (and the other demo apps) now serves the corresponding static bundle directly from the store

Verification

Locally verified:

• nix develop github:paolino/dev-assets?dir=mkdocs --quiet -c mkdocs build --strict
• nix eval --json .#apps.x86_64-linux --apply 'apps: builtins.attrNames apps'
• nix eval --json .#packages.x86_64-linux --apply 'pkgs: builtins.filter (name: builtins.elem name ["wasm-artifacts" "csmt-verify-wasm" "csmt-write-wasm" "mpf-verify-wasm" "mpf-write-wasm" "csmt-verify-wasm-demo" "csmt-wasm-write-demo" "mpf-wasm-write-demo" "docs"]) (builtins.attrNames pkgs)'
• nix build --quiet .#wasm-artifacts .#csmt-verify-wasm .#csmt-write-wasm .#mpf-verify-wasm .#mpf-write-wasm .#csmt-verify-wasm-demo .#csmt-wasm-write-demo .#mpf-wasm-write-demo .#docs
• local app smoke for nix run .#mpf-wasm-write-demo: index.html, mpf-write.wasm, and mpf-verify.wasm all returned 200

CI is the remaining gate before merge.

[github-actions]

Verify demo (read side): https://lambdasistemi-haskell-mts-pr-152.surge.sh
Build + prove + verify demo (CSMT write side): https://lambdasistemi-haskell-mts-pr-152.surge.sh/write-csmt/
Build + prove + verify demo (MPF write side): https://lambdasistemi-haskell-mts-pr-152.surge.sh/write-mpf/