fix(wasi): reject dynamic Net URL at compile time (symmetry with Fs)

[nelsonduarte]

Problem

A security/usability ASYMMETRY in the experimental --wasi mode, found in the pilot:

• A dynamic (non-literal) Fs path is refused at COMPILE time (clear WasmEmissionError in _validate_wasi_caps).
• A dynamic Net URL (e.g. interpolated "...?q=${name}") was NOT refused at compile time. The call site instead emitted a RUNTIME fail-closed (Err(IoError) without touching the network). A program with an Err(_) -> () arm swallowed that error silently and degraded its output with no warning (in the pilot, capa_governance_pack returned "no CVE matches" instead of 4, because the URL was interpolated).

We want SYMMETRY: a dynamic Net URL should also be refused at compile time, making the problem visible to the programmer instead of a silent degradation.

Fix

In _validate_wasi_caps (capa/ir/_emit_wasm/_wasi.py), right after the existing Fs dynamic-path refusal, add the symmetric Net refusal: when a request-building Net op (get/post) is used AND the NetCeiling is NOT closed (some dynamic URL reaches a request op), raise a WasmEmissionError at compile time with a clear message analogous to the Fs one, using the NetCeiling.closed flag (exact mirror of the Fs logic).

Coverage: the net ceiling is computed before _validate_wasi_caps runs and under the same get/post-used condition, and closed reflects EVERY get/post call site across the whole inlined module. So every dynamic-URL program is refused at compile time; no dynamic URL can still reach runtime unrefused.

The runtime fail-closed in the call-site emitter (_emit_wasi_net_get_call / _emit_wasi_net_post_call) is RETAINED as defence-in-depth.

Env is intentionally NOT aligned: it stays at Level 2 inherit_env on a dynamic key.

Tests

• Updated the two tests that previously asserted the runtime fail-closed (TestWasiNetCeiling / TestWasiNetPostCeiling) to assert the compile-time rejection.
• Added TestWasiNetDynamicUrlRejections: interpolated URL, param URL, let-bound literal, post param URL, mixed literal+dynamic, plus a literal-still-compiles positive control.
• Existing literal-URL Net tests (TestWasiNetGet/Post, attenuation) stay green; Fs behaviour unchanged.

Full suite: Ran 3437 tests ... OK (skipped=18).

Behaviour change

A --wasi program with a dynamic URL that previously "ran" (silent fail-closed) now does NOT compile under --wasi (visibility > silent degradation). Make the URL a string literal or use the default capa:host backend (drop --wasi). capa_governance_pack (interpolated URL) will be refused under --wasi until its URL is a literal; correct, handled in the program-update phase / when const-prop lands.