feat(runtime): add resident Wasmtime actor runtime

- define versioned service and clock WIT contracts\n- enforce import allowlists, fuel, epoch, memory, I/O, and mailbox limits\n- keep one Store and Component Instance resident per serial Actor\n- add echo, counter, fault, spin, and capability probe components\n- cover lifecycle, concurrency, sandbox, and fault recovery behavior

components/fault/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "fault-component"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[package.metadata.wasmeld]
+id = "fault"
+world = "component:fault/fault-component@0.1.0"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+wit-bindgen.workspace = true

components/fault/src/lib.rs

@@ -0,0 +1,21 @@
+mod bindings {
+    wit_bindgen::generate!({
+        path: "wit",
+        world: "fault-component",
+    });
+}
+
+struct Fault;
+
+impl bindings::Guest for Fault {
+    fn init(_config: Vec<u8>) -> Result<(), bindings::ServiceError> {
+        Ok(())
+    }
+
+    fn invoke(input: Vec<u8>) -> Result<Vec<u8>, bindings::ServiceError> {
+        assert_ne!(input, b"fault", "intentional test fault");
+        Ok(input)
+    }
+}
+
+bindings::export!(Fault with_types_in bindings);

components/fault/wasmeld.toml

@@ -0,0 +1,7 @@
+schema_version = 1
+
+[dependencies]
+"wasmeld:service" = "0.1.0"
+
+[replace."wasmeld:service"]
+path = "../../wit/service"

components/fault/wit.lock

@@ -0,0 +1,8 @@
+schema_version = 1
+
+[[package]]
+name = "wasmeld:service"
+version = "0.1.0"
+source = "path+../../wit/service"
+sha256 = "d5497307bbcd1e159f7707f385b488a6f2e26362d5256d5bc1080ac603a51305"
+replaced = true

components/fault/wit/world.wit

@@ -0,0 +1,5 @@
+package component:fault@0.1.0;
+
+world fault-component {
+  include wasmeld:service/service-component@0.1.0;
+}