feat: WebAssembly (WASM) build target for in-browser receipt verification

[mahirhir]

Summary

Enable compilation of the verification subsystem (gx-receipt, gx-crypto) to wasm32-unknown-unknown / wasm-pack.

Goal

Allow static web UIs, documentation viewers, and edge workers (Cloudflare Workers, Fastly) to verify DSSE signed receipts and checkpoint proofs client-side without a backend service or native binary installation.

Scope & Considerations

• Target crate: gx-receipt / gx-crypto
• Replace any OS-specific dependencies in the verification path with platform-agnostic abstractions or web-sys / getrandom JS features.

[mahirhir]

Status as of 2026-09-01: a first in-tree WASM verify SDK now exists at sdk/wasm-verify (crate + build script). I have not verified the build reproducibly in CI and no package has been published from it, so this stays open until there is a browser-usable artifact.

One correction: the crate names in the issue text (gx-receipt, gx-crypto) are stale — the verification path lives in gx-witness today.

[mahirhir]

Sharpening the residue, since the crate exists and the issue text does not say what is left.

sdk/wasm-verify/build.sh runs wasm-bindgen --target nodejs, so the glue that lands in sdk/typescript/src/wasm-gen is Node glue and a browser cannot load it as is. The remaining work is a web or bundler target output and something that ships it, not the Rust side: verify_receipt_offline already builds for wasm32-unknown-unknown and calls no host entropy, because the only getrandom caller in that graph is KeyPair::generate, which the verify path never reaches.

Body text repaired above as well. The code spans in it had been mangled into backslashes by a shell escape when the issue was filed, and the crate names it cites (gx-receipt, gx-crypto) are still the stale ones. Verification lives in gx-witness today.