fix(wasm): what the review found

-flto in a wasm configuration's compileFlags or linkFlags reached the
link, where LTO code generation runs without the backend options that
keep exception handling: every landing pad was dropped, and the build
succeeded with throws that escaped their catch blocks. -fno-exceptions
there made every `import std;` fail on the std module built with
exceptions, and a wasm shared library failed to link against the eh/
libc++, which is static archives built without -fPIC. Build() refuses
all three now, each with a line that says why, before it makes a
directory or starts a thread.

The sysroot check sat in BuildStdPcm, which the linter calls as well.
There the error only dropped the compile command, so lint ran no AST
rule on a wasm configuration and reported it clean. It also refused
static libraries, which never link, fired after the shader and
external threads had started, and called a missing sysroot, or one
without the target, "no C++ exception support". It is part of the same
early check now, which first says when the sysroot or the target's
directory is missing, and asks for libunwind only where something
links.

C sources got only the signal.h define. setjmp.h refused to compile in
C, and a C object given -wasm-enable-sjlj through compileFlags used the
legacy exception encoding next to C++ objects in the standard one, a
mix engines refuse to load. They get WasmCompileFlags now, like the C++
units, a variant pass's flags included.

The baseline probes include simd: V8 and SpiderMonkey switch SIMD off
on x86 CPUs without SSE4.1, which virtual machines often present, and
such an engine passed the exception-handling probe only to fail
compiling the module; the manifest tests expect it on every entry. The
Flatpak pins WASI_SDK_EXCEPTIONS=DUAL, which
wasi-sdk 34 defaults to only with clang 23 or newer, and checks that
the eh/ libunwind got installed: the wasm tests skip without it, so CI
would otherwise pass a Flatpak whose every wasm build fails.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

wasi-runtime/runtime.js

@@ -876,15 +876,18 @@ class Wasi {
 // GoogleChromeLabs/wasm-feature-detect, inlined so we ship no dependency. A
 // variant in variants.json lists the probe names that must all pass for that
 // variant to be served; an unknown name is treated as unsupported (we fall
-// through to a less demanding variant, ultimately the baseline). Keep the keys
-// in sync with the `probes` a WasmVariant declares in Crafter.Build, and with
-// WasmBaselineProbes, which every entry carries.
+// through to a less demanding variant, ultimately the baseline, and to an
+// error naming what is missing when not even the baseline fits). Keep the
+// keys in sync with the `probes` a WasmVariant declares in Crafter.Build, and
+// with WasmBaselineProbes, which every entry carries.
 const WASM_PROBES = {
     // relaxed SIMD: i8x16.relaxed_swizzle (Chrome 114+, Firefox 120+; Safari
     // still flag-gated as of mid-2026).
     "relaxed-simd": () => WebAssembly.validate(new Uint8Array([0,97,115,109,1,0,0,0,1,5,1,96,0,1,123,3,2,1,0,10,15,1,13,0,65,1,253,15,65,2,253,15,253,128,2,11])),
-    // fixed-width SIMD128 (v128.const + i8x16.popcnt) — the current baseline,
-    // here for completeness / future baseline shifts.
+    // fixed-width SIMD128 (v128.const + i8x16.popcnt), which every build
+    // uses (-msimd128). V8 and SpiderMonkey switch it off on x86 CPUs without
+    // SSE4.1, so it is a baseline probe even though every engine with
+    // exception handling has it.
     "simd": () => WebAssembly.validate(new Uint8Array([0,97,115,109,1,0,0,0,1,5,1,96,0,1,123,3,2,1,0,10,10,1,8,0,65,0,253,15,253,98,11])),
     // tail calls (return_call).
     "tail-call": () => WebAssembly.validate(new Uint8Array([0,97,115,109,1,0,0,0,1,4,1,96,0,0,3,2,1,0,10,6,1,4,0,18,0,11])),