fix(wasi): advertise the compiled smoltcp stack so subnet proxy can forward (#2734)

* fix(wasi): advertise the compiled smoltcp stack and keep ring out of the guest

A WASI guest has no OS TUN device, so the TCP subnet proxy can only forward
through the user-space stack. The capability probe in the WASI runtime only
set smoltcp_available under wasm-host-tunnel-outbound, so a plain core build
left force_smoltcp false and the proxy fell back to the kernel-listener path,
which rewrites the SYN onto a device that does not exist and lets every entry
expire as "syn nat entry expired".

- Add CoreInstanceHostConfig::set_smoltcp_stack and call it from the WASI
  runtime whenever the stack is compiled in. The setter only raises the flag,
  so the host-tunnel mode keeps working independently of the feature.
- wasi-crypto-offload no longer pulls ring-crypto: the host performs AEAD for
  the guest (easytier_host.crypto_aead_seal/open), and a software backend adds
  no value inside WASI.
- build-wasi-core.sh now builds with --no-default-features and an explicit
  list. endpoint-discovery was the only default that pulled rustls/ring; ring
  compiles C shims for wasm32-wasip1 that surface as env.ring_core_* imports,
  which the Go host cannot provide.

Covered by two unit tests for the setter.

* style(wasi): remove extra blank line from runtime module

Remove the extra blank line at the end of the WASI runtime module.
This restores the repository-wide cargo fmt check for PR #2734.

---------

Co-authored-by: 刘金发 <liujinfa9242@dingtalk.com>
Co-authored-by: KKRainbow <5665404+KKRainbow@users.noreply.github.com>

script/build-wasi-core.sh

@@ -10,7 +10,10 @@ cd "$repository_root"
 readonly target_dir="${CARGO_TARGET_DIR:-target}"
 readonly raw_artifact="${target_dir}/wasm32-wasip1/release/easytier_core.wasm"
 readonly artifact="${target_dir}/wasm32-wasip1/release/easytier_core_go_host.wasm"
-readonly core_features="management-rpc,proxy-smoltcp-stack,ring-crypto,wasi-crypto-offload"
+# The WASI host performs AEAD for the guest, and the guest has no TLS stack of its own, so the
+# default feature set (endpoint-discovery -> rustls -> ring) must stay off: ring compiles C
+# shims into wasm32-wasip1 that become env.ring_core_* imports, which the Go host cannot provide.
+readonly core_features="management,proxy-smoltcp-stack,wasi-crypto-offload,aes-gcm,tcp-hole-punch"
 
 sha256_file() {
     if command -v sha256sum >/dev/null; then
@@ -120,6 +123,7 @@ if [[ "$version" != *"version ${binaryen_version} "* ]]; then
 fi
 
 cargo build --release --target wasm32-wasip1 -p easytier-core \
+    --no-default-features \
     --features "$core_features"
 
 optimized="${artifact}.wasm-opt.$$"