WASM: free-threaded CPython 3.15t with pthreads, cross-origin isolation by default #175

User decision (2026-10-04), following #158 (free-threaded 3.15t is the only build):

• The wasm interpreter is also 3.15t, built by us (tools/wasm/build-cpython.sh) with pthreads; not Pyodide's GIL build. Unverified so far: whether --disable-gil builds for emscripten (CPython's bundled mimalloc has no emscripten-specific path); first task is that build.
• Cross-origin isolation (COOP: same-origin, COEP: require-corp or credentialless) is the default: toolchain generates the headers for the dev server and hosting config, and ships a service-worker fallback (coi-serviceworker style) for hosts that cannot set headers. The runtime checks crossOriginIsolated at start and fails with an explanation if it is false.
• Documented limits: embedding in third-party iframes, popup-based OAuth/payment (opener severed), cross-origin resources without CORP/CORS.
• Cost accepted: Pyodide's emscripten wheels do not load; compiled dependencies are built by pypackpack for wasm.
  Update docs/platforms/wasm-design.md and SPEC accordingly. Related: pypackpack Android release java resources consume generatePythonProperties without a task dependency #72, toolchain (header generation), pythonx-concurrent §3/§7 (wasm dispatchers become threads).