feat(varve): replace loom/meld/spar/synth/witness toolchains with varve

[avrabe]

Stacked on #606 — targets feat/varve-extension, not main. Merge order: #606 first, then this.

What

Wires this repo's own real toolchain resolution (not just the isolated examples/varve_extension) to varve for the five PulseEngine tools it covers today: loom, meld, spar, synth, witness.

Each <tool>_toolchain rule was already generic (a plain file-label attr) — only where the binary comes from changes: @varve_tools//:<tool> (signature-verified against //:rolling.pub, resolved from the layer pinned in //:varve.toml) instead of a per-tool GitHub-release download trusted on first use (checksums/tools/{loom,meld,spar,synth,witness}.json).

Removed the five <tool> = use_extension("//wasm:extensions.bzl", "<tool>") + register_toolchains() blocks from MODULE.bazel, replaced with one varve.configure(tools=[...]) + register_toolchains() pointing at the new //varve/toolchains targets.

wsc (signing) is deliberately untouched — a signing-path trust-source change gets its own explicit review, not a bundled one, matching how every wsc version bump in this repo's history has been handled.

Verification (real, not just resolved)

• loom: bazel build //test/p3:loom_optimize_build_test — genuine wasm_optimize run, observed byte-size reduction on the component.
• spar: bazel build //examples/spar_example:all — genuine AADL model → WIT codegen (codegen: wrote 1 file).
• synth, witness, meld: examples/synth_example and examples/witness_example both have a pre-existing gap on main, unrelated to this change — each references a .wasm fixture that was never checked in (confirmed via git show origin/main:..., not introduced here). So verified these three directly: resolved each real binary via bazel build @varve_tools//:<tool> and ran it — synth 0.60.0, witness-mcdc 0.43.0, meld 0.52.0 — all match the versions in the pinned layer's own signed manifest exactly.

Not done here (flagging, not silently deciding)

checksums/tools/{loom,meld,spar,synth,witness}.json and their tool_config.rs registrations in checksum_updater are now unreachable from this repo's own MODULE.bazel — but the old <tool> = use_extension(...) names and the download-based repository rules in toolchains/{loom,meld,spar,synth,witness}_toolchain.bzl are still public API; other bazel_dep consumers of rules_wasm_component may still use them. Deleting the registries out from under that path would break it.

Whether to also deprecate/remove that old public surface — a real breaking change, needing a compatibility_level bump and its own explicit call — is a separate follow-up, not bundled into this change.

🤖 Generated with Claude Code