Add native C ABI interoperability and protect build artifacts

[LunaStev]

Vex can now link prebuilt C ABI inputs from C, C++, and Rust and emit Wave objects or shared libraries for native consumers. Build output validation also prevents overwriting unowned or edited files, verifies promised artifacts, and preserves the original compiler failure when ownership bookkeeping fails.

Changes

• Add explicit, validated native.exports for Windows DLL C symbols; reject empty lists for Windows shared builds and preserve DLL/import-library pairs on failed export linking.
• Upgrade zip to 9.0.4 to resolve RUSTSEC-2026-0367/0368/0369, handle its fallible entry-name API, and regenerate locked dependency notices.
• Add strict native manifest configuration with target-specific inputs, package-local library lookup, and ordered transitive linking. Library packages default to object output; object/shared artifacts use package, target, and profile names.
• Integrate native configuration with metadata, doctor, JSONL artifact messages, isolated run generations, and clean. Supply stable ELF/Mach-O library identities and protect MSVC companion outputs.
• Reject unsafe output plans before compilation, including input aliases, paths outside the target directory, overlapping outputs, symlinks, hardlinks, and modified artifacts. Verify required outputs before reporting success, and retain primary compiler errors alongside secondary bookkeeping diagnostics.
• Add regression coverage, native interoperability documentation, and an actual-compiler C/C++/Rust smoke to all nine platform acceptance jobs.

Compatibility and scope

Uses the published Wave v0.2.1-pre-beta contract. This covers prebuilt C ABI inputs and object/shared outputs; foreign-language build hooks, binding generation, and static-library creation are outside this change. Imported Wave packages use explicit extern(c, "symbol") declarations for compatibility with that compiler release. Existing untracked outputs must be moved before Vex may overwrite them.

Validation

• python3 x.py check: formatting, 38 Python tests, workspace Rust tests (one subprocess fixture intentionally ignored), Clippy with warnings denied, and workspace build passed.
• Final CI fixes: the full check suite, native build regressions (17), 2,000 seeded parser mutations, external documentation links, and the dependency audit (zero findings or exceptions) passed. Windows GNU workspace/all-targets cross check passed after the dependency upgrade.
• Workspace/all-targets cross checks passed for Windows GNU, Linux aarch64, and Linux riscv64.
• Published Wave release: Linux amd64 C/C++/Rust inputs, transitive and mixed-order linking, C consumers of Wave object/shared output, and the existing package/re-export smoke passed.
• All nine targets produced valid object/shared dry-run plans (18 plans). Native execution on the other eight platforms remains subject to this PR's CI.
• Repository checks, documentation links, and git diff --check passed.

Closes #159
Closes #160

Related to #46, #47, and #54; their broader target/profile requirements remain open.