feat: implement hermetic Rust CLI for AOT embedding

Replace Python-based AOT embedding with native Rust implementation using
wasm-encoder and wasmparser crates. This eliminates external Python
dependency while maintaining full functionality for embedding and
extracting AOT-compiled artifacts as WebAssembly custom sections.

Key changes:
- Add tools/wasm_embed_aot: Hermetic Rust CLI with embed/extract/list commands
- Add wasm/wasm_embed_aot.bzl: Bazel rules for AOT artifact manipulation
- Add examples/aot_embed_test: Test example demonstrating functionality
- Update MODULE.bazel: Add wasm_embed_aot_crates for tool dependencies
- Update wasm/defs.bzl: Export new AOT embedding rules

The Rust implementation provides cross-platform compatibility and follows
existing repository patterns for hermetic tool building with Bazel.

Author: avrabe

MODULE.bazel

@@ -8,7 +8,6 @@ module(
 
 # Dependencies for WebAssembly tooling
 bazel_dep(name = "rules_rust", version = "0.65.0")
-
 bazel_dep(name = "bazel_skylib", version = "1.8.1")
 bazel_dep(name = "platforms", version = "1.0.0")
 bazel_dep(name = "rules_cc", version = "0.2.4")
@@ -234,7 +233,19 @@ crate.from_cargo(
         "x86_64-pc-windows-msvc",
     ],
 )
-use_repo(crate, "crates", "ssh_keygen_crates", "wasmsign2_crates", "wizer_crates")
+crate.from_cargo(
+    name = "wasm_embed_aot_crates",
+    cargo_lockfile = "//tools/wasm_embed_aot:Cargo.lock",
+    manifests = ["//tools/wasm_embed_aot:Cargo.toml"],
+    supported_platform_triples = [
+        "x86_64-unknown-linux-gnu",
+        "aarch64-unknown-linux-gnu",
+        "x86_64-apple-darwin",
+        "aarch64-apple-darwin",
+        "x86_64-pc-windows-msvc",
+    ],
+)
+use_repo(crate, "crates", "ssh_keygen_crates", "wasm_embed_aot_crates", "wasmsign2_crates", "wizer_crates")
 
 # Modernized WASM tool repositories using git_repository + rules_rust
 wasm_tool_repos = use_extension("//toolchains:extensions.bzl", "wasm_tool_repositories")

examples/aot_embed_test/BUILD.bazel

@@ -0,0 +1,87 @@
+"""Test case for AOT embedding functionality"""
+
+load("//wasm:defs.bzl", "wasm_precompile", "wasm_embed_aot", "wasm_extract_aot")
+
+package(default_visibility = ["//visibility:public"])
+
+# Create debug AOT artifacts with debug info (for comparison)
+wasm_precompile(
+    name = "hello_linux_x64_debug",
+    component = "//examples/basic:hello_component",
+    target_triple = "x86_64-unknown-linux-gnu",
+    optimization_level = "2",
+    debug_info = True,
+)
+
+wasm_precompile(
+    name = "hello_linux_arm64_debug",
+    component = "//examples/basic:hello_component",
+    target_triple = "aarch64-unknown-linux-gnu",
+    optimization_level = "2",
+    debug_info = True,
+)
+
+wasm_precompile(
+    name = "hello_portable_debug",
+    component = "//examples/basic:hello_component",
+    target_triple = "pulley64",
+    optimization_level = "2",
+    debug_info = True,
+)
+
+# Create production AOT artifacts for embedding (default - no debug info)
+wasm_precompile(
+    name = "hello_linux_x64",
+    component = "//examples/basic:hello_component",
+    target_triple = "x86_64-unknown-linux-gnu",
+    optimization_level = "2",
+)
+
+wasm_precompile(
+    name = "hello_linux_arm64",
+    component = "//examples/basic:hello_component",
+    target_triple = "aarch64-unknown-linux-gnu",
+    optimization_level = "2",
+)
+
+wasm_precompile(
+    name = "hello_portable",
+    component = "//examples/basic:hello_component",
+    target_triple = "pulley64",
+    optimization_level = "2",
+)
+
+# Test embedding stripped AOT artifacts (production)
+wasm_embed_aot(
+    name = "hello_with_embedded_aot",
+    component = "//examples/basic:hello_component",
+    aot_artifacts = {
+        "linux_x64": ":hello_linux_x64",
+        "linux_arm64": ":hello_linux_arm64",
+        "portable": ":hello_portable",
+    },
+)
+
+# Test embedding debug AOT artifacts (with debug info)
+wasm_embed_aot(
+    name = "hello_with_embedded_aot_debug",
+    component = "//examples/basic:hello_component",
+    aot_artifacts = {
+        "linux_x64": ":hello_linux_x64_debug",
+        "linux_arm64": ":hello_linux_arm64_debug",
+        "portable": ":hello_portable_debug",
+    },
+)
+
+# Test extraction
+wasm_extract_aot(
+    name = "extracted_linux_x64",
+    component = ":hello_with_embedded_aot",
+    target_name = "linux_x64",
+)
+
+wasm_extract_aot(
+    name = "extracted_portable",
+    component = ":hello_with_embedded_aot",
+    target_name = "portable",
+)

tools/wasm_embed_aot/BUILD.bazel

@@ -0,0 +1,18 @@
+"""WebAssembly AOT embedding tool as a hermetic CLI"""
+
+load("@rules_rust//rust:defs.bzl", "rust_binary")
+
+package(default_visibility = ["//visibility:public"])
+
+# Hermetic Rust CLI tool for AOT embedding and extraction
+rust_binary(
+    name = "wasm_embed_aot",
+    srcs = ["src/main.rs"],
+    edition = "2021",
+    deps = [
+        "@wasm_embed_aot_crates//:anyhow",
+        "@wasm_embed_aot_crates//:clap",
+        "@wasm_embed_aot_crates//:wasm-encoder",
+        "@wasm_embed_aot_crates//:wasmparser",
+    ],
+)