#1 ci: add reproducible plugin verification

Summary

• pin the supported Rust toolchain and WASM target
• add the central reusable plugin CI
• complete WASM extraction and resolution smoke coverage
• use upstream Extism 1.30.0

Validation

• 43 unit tests, 12 fixture tests and 4 WASM smokes pass
• native and WASM Clippy, release build and cargo audit pass

Linear: MAT-129

---

Summary by cubic

Adds reproducible plugin verification with a pinned Rust/WASI toolchain, locked commands, and centralized CI. Repins the reusable mpiton/vortex workflows and tightens smoke tests to assert the release .wasm exists.

• New Features

  • Pin Rust 1.95.0 and wasm32-wasip1 in rust-toolchain.toml.
  • Central Plugin CI using canonical mpiton/vortex reusable workflows pinned by SHA; minimal contents for verification and a separate, guarded tag release for the repo owner; repinned to latest SHAs.
  • WASM smoke tests call all runtime exports (can_handle, supports_playlist, extract_links, resolve_stream_url) via Extism http_request with a MediaFire fixture; now hard-require the release .wasm.
  • Contributor docs use locked fmt, clippy, build, and test with explicit native/WASM targets; satisfies Linear MAT-129.

• Dependencies

  • Upgrade extism (dev-dependency) to =1.30.0.
  • Refresh lockfile, updating wasmtime/cranelift/WASI-related crates.

Summary by CodeRabbit

• Testing

  • Expanded WASM smoke testing with a MediaFire fixture and validation of extraction and stream-resolution exports.
  • WASM tests now fail clearly when the required build artifact is missing.

• CI/CD

  • Added automated checks for pull requests, main-branch updates, and versioned releases.

• Documentation

  • Updated contributor and README instructions to clarify linting, formatting, WASM builds, and test order.

• Developer Experience

  • Pinned the Rust toolchain and development dependency versions for consistent builds.