feat(cli): add transformation attestation support

[avrabe]

Summary

Integrate wsc-attestation crate for supply chain security audit trails. When optimizing WASM modules, LOOM now embeds a cryptographic attestation in a custom section.

What's Added

• Dependency: wsc-attestation = "0.4" (optional feature, enabled by default)
• CLI Flag: --attestation (default: true, use --attestation=false to disable)
• Custom Section: wsc.transformation.attestation containing JSON attestation

Attestation Contents

{
  "version": "1.0",
  "transformation_type": "optimization",
  "attestation_id": "uuid",
  "timestamp": "ISO8601",
  "output": { "name": "output.wasm", "hash": "sha256...", "size": N },
  "inputs": [{ "artifact": {...}, "signature_status": "unsigned" }],
  "tool": { "name": "loom", "version": "0.1.0", "parameters": {"passes": "all"} },
  "metadata": { "instructions_before": N, "instructions_after": M }
}

Usage

# Attestation enabled by default
loom optimize input.wasm -o output.wasm

# Disable attestation
loom optimize input.wasm -o output.wasm --attestation=false

Benefits

1. Signature chain preservation - Verifiers can trace optimized modules back to original signed sources
2. Audit compliance - ISO 21434, IEC 62443, SLSA requirements for transformation traceability
3. Supply chain security - Each transformation step is cryptographically recorded
4. Reproducibility - Optimization parameters preserved for rebuild verification

Test plan

• Build with cargo build -p loom-cli
• Test attestation: loom optimize test.wat -o out.wasm → verify custom section exists
• Test disable: loom optimize test.wat -o out.wasm --attestation=false → verify no custom section
• Verify JSON structure with wasm-tools print

Closes #43