fix: temporarily disable wasmsign2 due to missing upstream binary

The wasmsign2 v0.2.7-rc.2 release referenced in MODULE.bazel does not exist.
The pulseengine/wasmsign2 repository is not accessible, and the official
wasm-signatures/wasmsign2 repository (latest: 0.2.6) does not publish
pre-built WASM binaries.

Changes:
- Comment out wasmsign2_cli_wasm http_file in MODULE.bazel
- Replace wasmsign2_wrapper with stub that fails gracefully at runtime
- Add TODO to re-enable when official binaries are available

This allows builds to complete while component signing functionality is
temporarily unavailable. The stub prevents build-time failures in targets
that reference wasmsign2_wrapper.

Author: avrabe

MODULE.bazel

@@ -204,12 +204,14 @@ http_file(
 )
 
 # wasmsign2 CLI WASM binary for component signing
-http_file(
-    name = "wasmsign2_cli_wasm",
-    downloaded_file_path = "wasmsign2.wasm",
-    sha256 = "0a2ba6a55621d83980daa7f38e3770ba6b9342736971a0cebf613df08377cd34",
-    url = "https://github.com/pulseengine/wasmsign2/releases/download/v0.2.7-rc.2/wasmsign2-cli.wasm",
-)
+# Commented out temporarily: release v0.2.7-rc.2 not available
+# TODO: Update to use official wasm-signatures/wasmsign2 when WASM binary is published
+# http_file(
+#     name = "wasmsign2_cli_wasm",
+#     downloaded_file_path = "wasmsign2.wasm",
+#     sha256 = "0a2ba6a55621d83980daa7f38e3770ba6b9342736971a0cebf613df08377cd34",
+#     url = "https://github.com/pulseengine/wasmsign2/releases/download/v0.2.7-rc.2/wasmsign2-cli.wasm",
+# )
 
 # WASM Tools Component toolchain for universal wasm-tools operations
 register_toolchains("//toolchains:wasm_tools_component_toolchain_local")

tools/wasmsign2_wrapper/BUILD.bazel

@@ -3,28 +3,50 @@
 This wrapper executes the pre-built wasmsign2.wasm component via wasmtime,
 resolving symlinks to real paths to work with both Bazel's sandbox and
 WASI's security model.
+
+TEMPORARILY DISABLED: wasmsign2 binary not available
+TODO: Re-enable when wasmsign2 WASM binary is published
 """
 
 load("@rules_go//go:def.bzl", "go_binary")
 
 package(default_visibility = ["//visibility:public"])
 
-# Wrapper binary that executes wasmsign2.wasm with path resolution
-go_binary(
-    name = "wasmsign2_wrapper",
-    srcs = ["main.go"],
-    data = [
-        "@wasmsign2_cli_wasm//file",
-        "@wasmtime_toolchain//:wasmtime",
-    ],
-    pure = "on",  # Pure Go for cross-platform compatibility
-    visibility = ["//visibility:public"],
-    deps = ["@rules_go//go/runfiles"],
-)
+# Temporarily commented out - wasmsign2 binary not available
+# # Wrapper binary that executes wasmsign2.wasm with path resolution
+# go_binary(
+#     name = "wasmsign2_wrapper",
+#     srcs = ["main.go"],
+#     data = [
+#         "@wasmsign2_cli_wasm//file",
+#         "@wasmtime_toolchain//:wasmtime",
+#     ],
+#     pure = "on",  # Pure Go for cross-platform compatibility
+#     visibility = ["//visibility:public"],
+#     deps = ["@rules_go//go/runfiles"],
+# )
+#
+# # Export for easy access in toolchains
+# alias(
+#     name = "wasmsign2",
+#     actual = ":wasmsign2_wrapper",
+#     visibility = ["//visibility:public"],
+# )
 
-# Export for easy access in toolchains
-alias(
-    name = "wasmsign2",
-    actual = ":wasmsign2_wrapper",
+# Stub target to prevent build failures while wasmsign2 is unavailable
+# This will fail at runtime if actually used, but allows builds to complete
+genrule(
+    name = "wasmsign2_wrapper",
+    outs = ["wasmsign2_stub.sh"],
+    cmd = """
+cat > $@ << 'EOF'
+#!/bin/sh
+echo "ERROR: wasmsign2 is temporarily unavailable" >&2
+echo "The wasmsign2 binary could not be downloaded from upstream" >&2
+exit 1
+EOF
+chmod +x $@
+    """,
+    executable = True,
     visibility = ["//visibility:public"],
 )