fix: upgrade wasmtime 27→36 (CVE fixes) and add Decl::Const match arms

Resolves 3 Dependabot alerts (wasmtime panic, resource exhaustion,
unsound shared memory access). Adds missing Const variant handling
in affine checker, linear checker, and LSP declaration extraction.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath