xtask: repair 7 stale wasm-fixture tests and gate cargo test -p xtask

[brandonpayton]

Why

cargo test -p xtask has been red with 7 failing unit tests since PR #605
(3430c5bbc, "Fix browser demos and artifact validation") added program
output/cache artifact validation — and, for one test, since ABI_VERSION moved
past 4. These are stale test defects, not product regressions: the fixtures
emit artifacts the (correct) validation rejects. They went unnoticed because
xtask's ~298 unit tests were entirely un-gated in CI — ci-run-test-suite.sh
and prepare-merge.yml build and run xtask but never run its own tests.

This blocks the validation-gates work (internal kd-u7f): a pre-merge gate that
runs xtask tests can't be enabled while these 7 are red.

Implements the triage design in
docs/plans/2026-07-02-xtask-stale-wasm-fixture-test-failures-triage.md
(internal kd-xc19 → kd-872c).

What

Repair the 7 stale tests (test-only; production validation unchanged):

• Class A (5 cmd_resolve_* tests): build scripts touched an empty
  .wasm, rejected as "is not a wasm binary". They now emit a valid minimal
  module via new emit_wasm_build_script + minimal_executable_wasm test
  helpers. The kernel output emits the full HOST_ADAPTER_REQUIRED_KERNEL_EXPORTS
  set built from the shared const, so it self-updates if that set changes.
• Class B (binaries_dir_program_fetch_does_not_require_built_deps): the
  fetched-archive fixture was a wasm header only (no exports), so cache
  validation forced a source-build fallback (a dep that exit 42s → panic). Now
  uses valid wasm, so the remote-first path the test means to prove is actually
  exercised.
• Class C (cli_produces_archive_with_canonical_filename): assertion
  hardcoded abi4 while the canonical filename correctly encodes the real ABI.
  Now version-relative via shared::ABI_VERSION, doubling as a guard that the
  filename encodes ABI_VERSION. (Its sibling ..._uses_build_toml_revision
  stays abi-pinned on purpose — it passes --abi "4" to test the revision
  field.)

Lock the class shut: a new negative test
wasm_artifact_policy_rejects_empty_and_exportless_when_exports_required asserts
empty/non-wasm → "is not a wasm binary" and export-less wasm → "missing
required exports" stay rejected, so the tests can't be "fixed" later by
weakening validation.

Close the gate gap: add a cargo-xtask suite to
scripts/ci-run-test-suite.sh and wire it into the prepare-merge,
staging-build, and force-rebuild suite matrices (not kernel-gated; ~16s, no
toolchain/workspace). Documented in docs/agent-guidance/validation.md and
docs/repository-organization.md.

Validation

cargo test -p xtask --target aarch64-apple-darwin: 290 passed / 7 failed →
298 passed / 0 failed (the 7 repaired + 1 new negative test). Confirmed green
at both the convoy base (ABI 15) and rebased on main (ABI 16). Verified the CI
path end-to-end via ci-run-test-suite.sh cargo-xtask, and check-abi-version.sh
reports the ABI snapshot unchanged. Not run (change touches none of these
surfaces): vitest, libc, POSIX, browser, kernel suites.

Follow-up (design open question): consider broadening the gate to
cargo test --workspace after auditing other un-gated workspace crates
(e.g. tools/mkrootfs).

🤖 Generated with Claude Code