### CI: WebAssembly runs under one pinned wasmtime with both its determinism settings, and the browser packages hold no relaxed SIMD

- **CI:** every workflow that runs a module under wasmtime runs wasmtime 50.0.1, pinned by version and SHA-256, with
  `-W nan-canonicalization=y -W relaxed-simd-deterministic=y`: every NaN a float instruction makes is the canonical
  one, and each relaxed SIMD instruction has one behaviour on every host. `wai-ops.yml` and `wai-vector.yml` ran
  38.0.3, and the quantum and face jobs 49.0.2, each with neither setting. The repository checks
  (`scripts/check-wasmtime-pin.py`) fail a workflow that pins another release or runs wasmtime without both.
- **CI:** `wai-web-wasm.yml` validates both of `wai-web`'s bundles and `reach/record/wai_web_bg.wasm` with relaxed SIMD
  and threads disabled (`wasm-tools` 1.250.0, pinned the same way), so a relaxed SIMD instruction, a shared memory or
  an atomic in any of them fails the job ([determinism-tiers](extensions/determinism-tiers.md) §5).
- The READMEs' commands that reproduce these jobs pass the same two settings. The quantum docs check holds a
  `VAR=value` before a command a `ci:` block names to a value the workflow gives `VAR`, so a documented runner cannot
  drift from CI's.

