[Copilot]

The Wasm test speed-ups narrowed source-compilation coverage and made runtime ordering load-bearing. This adds focused canaries without restoring expensive matrices or changing production behavior.

• Loading coverage

  • Add test_cpp_source.wasm without precompilation.
  • Cover source loading with allow_precompiled unset and precompiled-section stripping with it explicitly false.
  • Add one V8/downstream/HTTP1 integration request/response using the source-only module.

• Precompiled acceptance

  • Require a nonempty, V8-version-matched precompiled section and successful loading.
  • The pinned host exclusively deserializes that section; rejection fails loading rather than falling back. Failures already propagate to Envoy’s ERROR log, so no loader changes are needed.

• Coverage invariants

  • Assert V8 is the first sandbox runtime when compiled in.
  • Document first-runtime ordering and preserve WasmCommonTest as the primary full-matrix suite.

• Verification and limits

  • Formatting/lint, secret scanning, and Bazel target analysis passed.
  • Test execution remains unverified: the cold-cache runtime-test build expanded to approximately 4,000 actions and was stopped. CodeQL skipped C++ analysis due to database size.
  • Rust source-only coverage is deferred; all existing speed-ups remain intact.

Risk: low; test-only changes. Docs/release notes: N/A. AI-assisted implementation.