Wasm sandbox

Each run gets a fresh QuickJS runtime compiled to WebAssembly (quickjs-emscripten 0.32.0, pinned), with a wall-clock deadline, a memory cap and a stack cap. Only console.log is exposed: no fs, network, timers or process.