Expand description
Rust WASM plugin runtime — mirror of TS PluginRegistry WASM path.
Each plugin’s host imports are gated through the supplied
CapabilityCheck callback. A plugin that calls a host function
whose capability is denied gets a runtime trap.