fix(355): --component lifts bare world exports with real signatures

[avrabe]

What

Fixes #355 — fuse --component emitted an invalid component for any export
with a non-empty signature. Reproduced on avrabe's exact fixtures.

Root cause (three latent defects)

Bare world exports (world root { export get-b: func(i: s32) -> u32 }) took a
path that hardcoded an empty (func) type. Digging in surfaced three bugs:

1. Parser (ComponentFuncDef): exporting a Func binds a new
   component-function index (an export alias); wit-component interleaves these
   with canon lifts. The parser recorded them nowhere, so the func index space
   was silently compacted and component_func_defs[export.index] mis-resolved
   (get-b ✓, set-b/ptr-b shifted). Fixed by recording
   ComponentFuncDef::ExportAlias.
2. Wrapper no-result func: func_enc.result(None) was never called for a
   void-returning export (set-b), leaving the type unterminated → decoder
   EOF. (Latent until a no-result export routed through this helper.)
3. Wrapper export-alias skip: the bare-export emitter advanced the
   component-func index by 1 per export, but each export also binds an alias
   index — so every export referenced the previous export's alias. Fixed to
   advance by 2.

Result

get-b: func(i:s32)->u32, set-b: func(i:s32,v:u32), ptr-b: func()->u32 — all
correct, output validates. The standard {iface}#{func} interface path is
untouched.

Tests / falsification

component_bare_export_355.rs (single + two-component) on tests/reloc351/{a,b}.wasm:
asserts a valid component (wasmparser::Validator, all features) and the
correct per-export arity (get-b (1,1), set-b (2,0), ptr-b (0,1)) — the first
catches the empty-type + no-result bugs, the second catches the index shift.

Full meld-core suite green (no regression from the parser index-space change);
fmt + clippy clean. SR-54 (verified); CHANGELOG. Tier-5 (parser/component_wrap/
p3_stream) → Mythos discover pass to follow on this PR.

Refs #355

[github-actions]

Mythos delta-pass required

This PR modifies one or more Tier-5 source files (per
scripts/mythos/rank.md):

meld-core/src/component_wrap.rs
meld-core/src/p3_stream.rs
meld-core/src/parser.rs

Before merge, run the Mythos discover protocol on the
modified Tier-5 files:

1. Follow scripts/mythos/discover.md
   — one fresh agent session per touched Tier-5 file.
2. For each finding, the agent must produce both a Kani
   harness and a failing PoC test (per the protocol's
   "if you cannot produce both, do not report" rule).
3. Attach a comment on this PR with either the findings
   (formatted per discover.md's output schema) or
   NO FINDINGS.
4. Add the mythos-pass-done label to this PR.

Why this gate exists: LS-A-10
(CABI alignment padding in async-lift retptr writeback) was
found by the v0.8.0 pre-release Mythos pass — but it had
lived in the callback emitter since #128, across six
releases. A PR-time gate would have caught it at review
time instead of at the release boundary.

The gate check on this PR will pass once the label is
applied.

[github-actions]

LS-N verification gate

✅ 59/59 approved LS entries verified

	count
Passed (≥1 test, all green)	59
Failed (≥1 test failure)	0
Missing (no ls_*_NN_* test found)	0

_{Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.}

Failed LS entries

(none)

Missing regression tests

(none)

_{Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.}

[github-actions]

Mythos delta-pass (auto)

✅ NO FINDINGS across 3 Tier-5 file(s)

File	Verdict	Hypothesis
``	✅ NO FINDINGS	—
``	✅ NO FINDINGS	—
``	✅ NO FINDINGS	—

_{Auto-run via anthropics/claude-code-action@v1
(SHA-pinned) on the touched Tier-5 files, using the
maintainer's Max-plan OAuth token. See
.github/workflows/mythos-auto.yml and
scripts/mythos/discover.md.}

[avrabe]

Mythos delta-pass — findings

Three clean-room adversarial discover passes (fresh-context agents), one per
changed Tier-5 file. Verdict: no reportable bug on the #355 change itself; one
real sibling bug found and fixed in the same PR.

parser.rs (ComponentFuncDef::ExportAlias) — CLEAN

Every consumer of component_func_defs uses variant-specific match/if let;
none assume the (previously compacted) length or iterate expecting only the old
three variants. The change is order-preserving by construction (entries
pushed in binary section order), so alignment holds for any section ordering, not
just the fixture. Notably it also improves resolver.rs correctness — its
func-index→name maps were keyed by the compacted space pre-fix and could
mis-resolve interleaved cases.

component_wrap.rs — CLEAN on the #355 change; found a sibling bug (fixed)

The += 2, post-return, result(None), and type-carry changes all verified
correct (mixed interface+bare, string-returning, void, fallback cases).
But the same index-desync exists in the interface-export loop: it advanced
component_instance_idx by 1 while exporting an instance also binds an
export-alias index — so a component exporting ≥2 interfaces silently bound
the 2nd+ export to the previous interface's alias, exporting the wrong functions
(the output still validated — silent; UCA-CP-1). Confirmed with a Kani harness +
a differential PoC. Fixed in commit e115719 (+= 2) with a regression test
(component_multi_interface_instance_idx.rs).
Noted (not reported — no reachable PoC): type_remap is keyed only by
source_type_idx; a defensive key of (component, source_type_idx) would harden
against a future cross-component collision.

p3_stream.rs (new ExportAlias match arm) — CLEAN

Unreachable for the #355 fixtures (they hit Lift directly); when hit it follows
one hop to the real Lift/Import (no cycle/panic/OOB — single .get()).
Empty-result only feeds the #142 stream-mismatch diagnostic, which has a
role-list fallback, so no fused-byte divergence is producible.

Full meld-core suite green after both commits. Adding mythos-pass-done.