Move the WASM plugin host to the wasmtime 36 LTS

[LinuxJedi]

Stacked on #274 (base is that branch, so this diff stays to the wasmtime move;
GitHub retargets to main once #274 merges).

Why now

wasmtime was pinned to 27.0.0, a line that never received security backports --
fixes land on the 24.x and 36.x LTS branches and on current. Twelve upstream
advisories formally cover 27.x as a result.

None were reachable in this configuration (Cranelift-only, no WASI, no component
model, no threads, wasm_simd(false), default allocator), which is why #274 left
it alone. But the next advisory would not be fixed there either, and the only
thing that made the pin awkward to move -- save-state determinism -- is already
moot this cycle, since 0.13 breaks states against 0.12 regardless.

What moved

=27.0.0 -> =36.0.12, the current LTS tip:

• Advisory-clean. 24.x LTS still carries six; 36.0.12 has none.
• MSRV 1.86, under the crate's 1.87.
• No source changes. The embedding API used here is unchanged across the
  jump -- Engine/Store/Linker/Module, func_wrap, get_typed_func,
  Memory read/write/grow/size, set_fuel, and the determinism Config knobs
  all compile untouched, so wasmboard.rs is not modified.
• Net five crates added to the lock; paste drops out entirely.

The pin stays exact and its comment now records the LTS policy, so the next
update tracks a supported line rather than whatever is newest.

STATE_VERSION 39 -> 40

A board snapshot stores a linear-memory image replayed against a module
recompiled at load time. The serialized shape therefore does not change, so
an existing state would deserialize happily and then run against different
codegen -- a silent divergence rather than a clean refusal. The version bump
makes it refuse. Costs nothing extra: 0.13 already breaks states against 0.12
(27 -> 39).

Verification

Release build, fmt, clippy --all-targets --all-features --locked -D warnings
all clean. Unit suite 1839 passing, including all 9 wasmboard tests --
save_state_round_trip_is_byte_identical, memory_grow_round_trips_through_a_snapshot,
reset_clears_plugin_memory and runaway_plugin_loop_traps_on_fuel_instead_of_hanging
among them. 22 golden renders passing. Full --ignored suite passing
(image_regression 8/8, mb_ram 3/3, vamiga_ts 1/1). Headless boot smoke fine.

cargo-sources.json regenerated. No docs pin a wasmtime version, so none needed
updating.

The advisory sweep over the whole lock drops from 34 matches to 2, both
unmaintained notices with no patched version available (bincode 1.3.3, which is
the save-state encoding, and ttf-parser 0.25.1 on the Linux font path).

[Copilot]

Pull request overview

This PR updates Copperline’s optional WASM plugin host dependency (wasmtime) from the unsupported 27.x line to the 36.x LTS line, and bumps the emulator save-state format version to prevent older states from being resumed under different WASM codegen behavior.

Changes:

• Pin wasmtime from =27.0.0 to =36.0.12 (LTS) while keeping the existing lean feature set (cranelift, runtime, no default features).
• Bump savestate::STATE_VERSION from 39 → 40 to force rejection of older states that could otherwise deserialize and then diverge at runtime due to recompilation under a different wasmtime.
• Regenerate Cargo.lock and Flatpak cargo-sources.json to reflect the updated dependency graph.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
src/savestate.rs	Bumps STATE_VERSION to 40 and documents the rationale tied to the wasmtime upgrade.
Cargo.toml	Updates the exact wasmtime pin to =36.0.12 and records the LTS/backport and save-state implications.
Cargo.lock	Updates the resolved dependency tree for the wasmtime 36.x LTS line.
packaging/flatpak/cargo-sources.json	Regenerates vendoring sources to match the updated lockfile for Flatpak builds.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.