feat: build environment attestation for SLSA provenance

[avrabe]

Summary

• BuildEnvironment module auto-captures toolchain versions (rustc, cargo, Bazel, wasm-tools), Nix flake lock hash, and host platform
• SLSA integration: to_slsa_internal_params() produces JSON for SLSA BuildDefinition.internalParameters
• CLI: wsc build-env subcommand with --json (machine-readable) and --from-env (CI override via WSC_* vars)
• Rivet artifacts: REQ-13, CD-19, CV-27

Example output

Build Environment Attestation
=============================
  rustc:       rustc 1.90.0 (1159e78c4 2025-09-14)
  cargo:       cargo 1.90.0 (840b83a10 2025-07-30)
  bazel:       8.5.1
  wasm-tools:  wasm-tools 1.245.1
  nix lock:    d92a66d453c3e442c15...
  platform:    aarch64-macos
  os:          Darwin 25.3.0

  [reproducible: nix flake lock pinned]

Test plan

• cargo check — workspace compiles
• cargo test -p wsc -- build_env:: — 9/9 tests pass
• cargo run -p wsc-cli -- build-env — CLI works
• cargo run -p wsc-cli -- build-env --json — JSON output valid
• CI cargo + bazel builds pass

Closes #49

🤖 Generated with Claude Code