nx_wasm_vm_exec_gate.nx

nx_wasm_vm_exec_gate.nx -- R1+R2: the sovereign WASM VM EXECUTES the real nx_vcodec.wasm and we DIFF it against the native codec. R1 validates the executor on functions that touch NO byte memory (constant accessors + the pure-integer vc_vbits with its calls/control-flow) -- if those match native, the VM's arithmetic, calls, and structured control are sound. R2 then runs the actual codec (vc_wasm_encode -> vc_wasm_decode) on a real 16x16 frame and compares the independent-decoder output to the native packed codec's. If R1 passes but R2 diverges, the fault is the wasm's u8 memory access -- the exact thing this VM exists to catch.