fix: reject unmetered private Component resource allocators

Address formal review R1 by failing closed on guest resource definitions and canonical resource.new in outer and nested Components before Store creation. Preserve shared artifact/ABI verification and imported Host connections; regress resource ceilings zero/default, 64 live handles in core start, nested definitions and fresh execution after rejection.

crates/plugin-runtime/Cargo.toml

@@ -14,6 +14,7 @@ thiserror.workspace = true
 tokio = { workspace = true, features = ["rt", "macros", "sync", "time"] }
 tokio-util = { version = "0.7", features = ["rt"] }
 jsonschema = { version = "0.33.0", default-features = false }
+wasmparser = "0.244.0"
 wasmtime = { version = "=38.0.4", default-features = false, features = ["async", "component-model", "cranelift", "runtime", "std", "threads"] }
 
 [dev-dependencies]