[howlcipher]

M4 task 1–2 (delivery). Stacked on #295 (the probe), whose single commit this branch carries; once #295 merges, this PR's diff is only its own commit.

• build --target wasmgc --inline-module (a web_app for the browser) writes one app.js: the browser loader with the module's bytes as base64, decoded with atob before WebAssembly.compile. Nothing is fetched, so a page's policy needs only 'wasm-unsafe-eval' in script-src (plan, "Site delivery").
• The loader's source of bytes is now its own part: browserFileSource (fetches app.wasm beside the script, or takes howlFrameWasm) or inlineSource. The inline loader contains no fetch( and no file name.
• Fails closed: it needs --target wasmgc and a web_app built for the browser (--tests and cli_app are refused).
• Added to interopCommands.

Test Impact Assessment

• Behavior changed: a new build option. The existing app.wasm + app.js output is unchanged apart from where howlFrameBytes is defined and the header line.
• Tests that prove it:
  • TestBrowserInlineModule: the inline page matches the page with app.wasm (text, classes, a click handler, a scroll subscription, a caught error), and the script contains no </script and no module file or fetch.
  • TestBrowserInlineModuleFailsClosed: the three refusals.
  • TestHowlSceneSiteGate now builds HowlScene HF's site runtime three ways (JS, wasmgc with app.wasm, inline) and requires one page. Its stand-in page gained atob, which every browser page has; without it the inline build failed with "atob is not defined".
• Real browsers (not in CI): the inline site runtime (79,765 B, 24,084 B gzipped) runs in Chromium 156 and Firefox 157 under both HowlScene HF page policies with 'wasm-unsafe-eval' added. The probe script and its output are in the M4 journal.
• Gaps: WebKit doesn't start on this machine. HowlFrame CI has no browser, so the policy check lives in HowlScene HF's Playwright specs (a later slice).
• Tests actually run, on the final tree (2991f47b):
  • HOWLSCENE_HF=… scripts/wasmgc_gate.sh: passed. Go 1.26: 4,520 tests passed, 31 skipped elsewhere by design. Go 1.27.2: 4,518 passed, 33 skipped. HowlScene HF gates: 7 passed.
  • A direct build --target wasmgc --inline-module of src/site/site.howl.
  • An earlier gate run failed in apps/task_api because an orphaned server from a gate run I had stopped was still holding port 8091. I killed it and reran; that rerun is the result above.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AcSTmyDDtEcBifmcTbNcRW