component-test CLI: composition, execution, aggregation

[lann]

A single CLI that hides the plumbing (wasi-test's future-ideas list called for this):

• compose: wrap wac plug for suite + runner (+ provider components under test), with the recipes documented for people who want the raw commands.
• run: pick a runner (cli/http/browser/native), pass filters and missing-features (read from the targets manifest), collect canonical results JSON.
• list / update-lock / update-ratchet / aggregate / emit --format junit|tap.
• Negative composition gates: assert that a given suite does not compose with a given provider, matching the error on the specific interface name. Webcrypto's class-d-composition gate is the prior art, and the failure mode is subtle — wac plug tolerates unsatisfied imports, so the assertion must pin why composition fails, not just that it does.

[lann]

Status: the CLI shipped and owns the results/inventory half — lock (with --leaves), fold, aggregate, emit junit, and the pins gate + pins bump. From this issue's original list, update-ratchet was superseded by #48's manifest expected-fail declarations (hand-maintained with required rationale), and list is served by ct-runner --enumerate. Genuinely remaining: compose (tracked as #19, wac-graph, including the open-set sideband-provider duty), any run orchestration wrapper if one is still wanted, and the negative composition gates — which have real subtlety (wac plug tolerates unsatisfied imports, so the gate must pin why composition fails) and no upstream implementation yet. Re-scoping this issue to those three, or splitting them out, is the natural next step.

[lann]

Charter status after #86 (clap migration + new subcommands):

• compose → compose-runner landed, as a library (wac-graph, component-test CLI: compose via wac-graph, not wac script + binary #19 — now closed) rather than wrapped wac plug; embedded reference provider + runner-core defaults, --provider/--runner overrides, bundle inputs supported. The raw wac recipes stay documented in examples/compose for custom topologies.
• run → landed for the wasi:cli runner kind: compose + execute under an embedded wasmtime (p2+p3), --jsonl for the canonical wire format, exit code from the guest. Other runner kinds (http/browser/native) remain open here.
• list / update-lock → lock (with --check/--leaves) has covered this since M1.2: feature-mark metadata + lockfile formats (and custom-section survival spike) #29-era work; no separate list yet.
• aggregate / emit → aggregate and emit junit landed earlier (M1.3: results implementation — WIT event types, JSONL edge encoding, aggregator, matrix #30, Interop emitters: JUnit XML, TAP, GitHub Actions annotations #11); TAP remains open.
• Also landed under this charter's scope umbrella: pins/pins bump (CLI: pins — one-rev-everywhere gate for downstream pin trios #54/pins --bump: mechanical multi-site pin bump for consumers #60) and wizen (Productize wizer pre-initialization: library entry point, setup action, discoverability #85).

Still open from the original list: negative composition gates — worth noting the wac-graph route (#86) makes these much more tractable than the wac-CLI wrapping this issue anticipated: composition failures are now typed set_instantiation_argument errors with the interface name in hand, so "assert this suite does not compose with this provider, because of this interface" can be a precise assertion instead of stderr-grepping wac output. Plus run for other runner kinds, TAP, and update-ratchet.