Add load-time WASM guard ABI checks and align guard unit runtime config

[Copilot]

github.com/tetratelabs/wazero guards were only validated for export presence, so ABI mismatches could surface later as runtime traps. This PR adds explicit signature validation during guard load and aligns guard parse coverage tests with interpreter-mode runtime usage for deterministic unit behavior.

• Guard initialization hardening

  • Validate required exports (label_resource, label_response, label_agent) against the expected ABI: (i32,i32,i32,i32) -> i32.
  • Return a targeted load-time error when signatures don’t match, instead of deferring failure to invocation time.

• ABI mismatch coverage

  • Add focused test coverage for invalid exported function signatures by mutating the wasm type section and asserting the new signature error path.

• Unit test runtime consistency

  • Update wasm_parse_coverage_test helper setup to use wazero.NewRuntimeConfigInterpreter() rather than default runtime config, matching existing guard test conventions.

if !slices.Equal(paramTypes, expectedParamTypes) || !slices.Equal(resultTypes, expectedResultTypes) {
	return fmt.Errorf(
		"WASM module function %s must have signature (i32,i32,i32,i32)->i32, got %v->%v",
		functionName, paramTypes, resultTypes,
	)
}

[Copilot]

Pull request overview

This PR hardens WASM guard loading by validating exported guard function ABIs at load time, preventing signature mismatches from surfacing later as runtime traps. It also aligns a guard parsing coverage helper to use the interpreter runtime config for deterministic unit-test behavior.

Changes:

• Validate label_resource, label_response, and label_agent exported function signatures against the expected (i32,i32,i32,i32)->i32 ABI during NewWasmGuardWithOptions.
• Add a focused unit test that mutates the WASM type section to assert the new ABI-mismatch error path.
• Switch wasm_parse_coverage_test runtime initialization to wazero.NewRuntimeConfigInterpreter() to match existing guard test conventions.

Show a summary per file

File	Description
internal/guard/wasm_lifecycle.go	Adds load-time signature validation for required exported guard functions.
internal/guard/wasm_new_options_coverage_test.go	Adds test coverage for invalid exported function signatures via WASM byte mutation.
internal/guard/wasm_parse_coverage_test.go	Updates helper runtime setup to use interpreter mode for deterministic tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Low