feat(rustledger): in-process Component-Model engine behind a flag

[robcohen]

Adds an experimental, flag-gated rustledger engine that drives the typed
WASI Preview 2 / Component-Model component (rustledger-ffi-component,
rustledger #1384)
in-process via wasmtime-py — the successor to the current JSON-RPC engine,
which spawns the wasmtime CLI once per call and exchanges hand-mirrored JSON
DTOs over stdin/stdout.

What's here

• RustledgerComponentEngine (src/rustfava/rustledger/component_engine.py)
  loads the component once, instantiates it with WASI p2, and calls the typed
  ledger / util / format exports directly (no JSON envelope, no
  subprocess). It mirrors RustledgerEngine's surface: version, load,
  query, validate, format_entries, get_account_type, is_encrypted,
  load_full.
• A generic, type-driven marshaller (_marshal) converts the component's
  typed Record/Variant/list values into plain Python dicts/lists by
  walking the component's own type metadata (RecordType.fields,
  VariantType.cases). Variants render as discriminated {"type": <case>, ...}
  (mirroring the JSON-RPC tagged unions), so there are no hand-maintained
  per-type field lists.
• get_engine() (rustfava.rustledger) selects the backend via
  RUSTFAVA_RUSTLEDGER_BACKEND=component; the default stays the JSON-RPC engine.
  The component module — and therefore wasmtime — is imported lazily, so
  the default path gains no new dependency. wasmtime is a new optional
  component extra.

Why now (and why behind a flag)

This is the consumer-migration proof for the rustledger Component-Model work.
The component is still publish = false upstream (rustledger ADR-0006 Phase 3),
so rustfava can't ship against a released artifact yet — but the in-process
typed-host path is now proven end-to-end, ready to flip on when it releases.
The in-process model also removes the per-call subprocess cost and the JSON DTO
drift.

Testing

tests/test_rustledger_component_engine.py covers version / load (typed
directive marshalling) / query / account-type / load_full (include resolution
over a WASI pre-open). They skip unless wasmtime is installed and the
wasip2 artifact is locatable (RUSTLEDGER_COMPONENT_WASM or bundled). Build it
with:

cargo build -p rustledger-ffi-component --target wasm32-wasip2 --release

• Component tests: 5 passed (against a local build).
• Default path unaffected: existing engine tests pass, and importing
  rustfava.rustledger pulls in no wasmtime.
• ruff check + ruff format clean.

Follow-ups (not in scope here)

• Bundle the component .wasm and flip the default once it's a release artifact.
• load_full currently pre-opens only the entry file's directory tree, so
  cross-tree (../) includes are unreachable; a wider pre-open root would lift
  that (documented in the method).

🤖 Generated with Claude Code