Test and run over the wasm boundary, and two decisions written down

[onatozmenn]

Closes #590. Closes #591.

deed-wasm gets deed_test and deed_run alongside deed_check, same shape: write to a buffer from deed_alloc, call, read JSON back through deed_result_ptr/deed_result_len. test needs no capability decision at all, a test block takes no parameters so nothing in one can hold a capability.

#591: a page offers Io.write and Io.now, nothing else, decided rather than attempted and left to fail two different ways (Io.epoch has no fallible form on this target and traps; the directory operations fail safely but with a raw io::Error nobody chose to write). unsupported_capabilities reads main's row and turns every other Io operation into one sentence (this page does not offer `Io.save` yet), checked before anything runs rather than discovered by an OS error partway through.

#590: MAX_DEPTH already turns unbounded recursion (the only way to not return, since there is no while) into DEED6009 rather than a hang, on every host. The residual question, a fuel limit or a worker thread, is decided as the worker thread, and it is the page's job: a fuel limit would tax every embedder for a failure mode that is the existing "time and memory are also resources" open question, not a new one, and a page already has the tool that fits it. Both decisions and the reasoning are in design/04-capabilities.md.

A new test proves a mutually recursive Diverge program terminates with the depth error rather than hanging, run through deed_run itself.

Stacked on #682 (wasm entry point) for the deed-wasm crate; will show a clean diff once that merges.