feat(verify): L15 capabilities + L2 access-sites codecs (proposals 0001 §3 + 0002 §3) (#107)

## Summary

Lands the remaining codec halves for proposals 0001 + 0002 (just
promoted to \`[review]\` in #104):

- **L15 capabilities** behind new \`unstable-l15\` feature → closes
proposal 0001 §Acceptance criterion 3 (capabilities side; regions side
was already landed)
- **L2 access-sites** behind existing \`unstable-l2\` feature → closes
proposal 0002 §Gate 3

Both wire formats follow the proposal specs exactly. Net +467 lines
(mostly tests + docs).

## Files

- \`crates/typed-wasm-verify/Cargo.toml\` — new \`unstable-l15\` flag;
widened \`unstable-l2\` docstring to cover access-sites.
- \`crates/typed-wasm-verify/src/section.rs\` — two new codec sections,
sharing the existing \`LenientReader\` / \`read_u16_le\` / \`read_utf8\`
/ \`write_utf8\` helpers (helpers widened from \`unstable-l2\` only to
\`any(unstable-l2, unstable-l15)\`).

## Wire formats

- **\`typedwasm.capabilities\`**: \`u16le version\` + \`u32le
capability_count\` + \`{u32le name_len, u8[] name}*\` + \`u32le
function_count\` + per-function \`{u32le func_idx, u32le required_count,
u32le[] required_indices (strictly increasing)}\`. Parser defensively
sort+dedups \`required\` to recover \`DistinctCaps\` even if a future
producer regresses.
- **\`typedwasm.access-sites\`**: \`u16le version\` + \`u32_leb128
entry_count\` + per-entry \`{u32_leb128 func_idx,
instruction_byte_offset, region_id, field_id}\`. Encoding B per proposal
0002's adopted choice (~5 B/entry, ~1.1% module overhead at fixture
scale).

## Tests

12 new tests, all gated. All 4 feature combinations green:

| features                       | tests passed |
|--------------------------------|--------------|
| (default)                      | 43           |
| \`unstable-l2\`                | 59           |
| \`unstable-l15\`               | 50           |
| \`unstable-l2,unstable-l15\`   | 66           |

Coverage per new section: empty / version-only / wrong-version edge
cases, round-trip for small + large values, LEB128 boundary values
(127/128/16383/.../u32::MAX), parser-normalises-unsorted-required
(DistinctCaps recovery), truncated payload zero-fills.

## What this does NOT do

- No \`verify_capabilities\` / \`verify_access_sites\` pass (needs
cross-section verification — access-sites references region_id+field_id
from the regions table, so MissingDependentCarrier semantics from
proposal 0002 §"Producer obligations" #2 apply). Tracked under #106
§"Sequencing recommendation".
- No spec doc update (proposal 0001 §Criterion 4 + 0002 §Gate 5).
Separate doc PR.
- No status flip on the proposals — they stay \`[review]\` until
cross-repo producer codegen issues complete + spec doc lands.

## Test plan

- [x] \`cargo build\` (default features) succeeds
- [x] \`cargo test --lib\` (default) → 43 passed
- [x] \`cargo test --lib --features unstable-l2\` → 59 passed (+16: 8
regions + 6 access-sites + 2 helper)
- [x] \`cargo test --lib --features unstable-l15\` → 50 passed (+7: 6
capabilities + 1 helper)
- [x] \`cargo test --lib --features unstable-l2,unstable-l15\` → 66
passed (all gated tests visible)
- [x] No regression in \`tests/\` integration suite

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

crates/typed-wasm-verify/Cargo.toml

@@ -14,9 +14,19 @@ default = []
 # 0001 (typed-wasm#76, refs #34). UNSTABLE: wire format may change before
 # the proposal is [accepted]. Enables `parse_regions_section_payload` /
 # `build_regions_section_payload` and the `RegionEntry` / `FieldEntry`
-# types. Does NOT enable a `verify_region_binding` pass — that needs an
-# access-site carrier still under design (see proposal §Open Questions).
+# types. Also enables `parse_access_sites_section_payload` /
+# `build_access_sites_section_payload` and `AccessSiteEntry` from
+# proposal 0002 (#78) — access-sites is an L2 enforcement carrier and
+# travels with the L2 feature gate. Does NOT enable a
+# `verify_region_binding` pass — that's a separate plumb step.
 unstable-l2 = []
+# Pre-stages the L15 capability-lattice carrier codec for typed-wasm
+# proposal 0001. UNSTABLE: wire format may change before [accepted].
+# Enables `parse_capabilities_section_payload` /
+# `build_capabilities_section_payload` and the `CapabilityEntry` /
+# `FunctionCapabilities` types. L15-C (per-call-site grants) is deferred
+# to a separate proposal (tracked by #96).
+unstable-l15 = []
 
 [dependencies]
 # Exact pins: wasmparser's 0.x line ships API breaks on every minor bump