feat(per-actor): PerActorTvmHost wrapper for per-store budget enforcement

Adds a per-store budget wrapper around `SharedTvmHost` so embedders can
host *untrusted* actors on a shared substrate without one being able to
exhaust the directory for the others. Designed and requested by the
girder runtime — its E1 (host-side enforcement for untrusted tvm
actors) was previously blocked on a tvm-wasm hook; this commit is that
hook.

- `PerActorTvmHost { inner: SharedTvmHost, budget, state }`: per-store
  outstanding-bytes accounting + overrun flag. `inner` is a regular
  `SharedTvmHost` clone — two `PerActorTvmHost` instances built from
  `shared.clone()` see the same regions but track budgets independently.
- `TvmBudget::{unlimited, outstanding_bytes(u64)}`: 0 = unlimited (the
  fast path delegates with no accounting overhead — drop-in replacement
  for `SharedTvmHost` at zero perf cost when unused).
- All four host traits (`types::Host`, `manager::Host`, `bytes::Host`,
  `diagnostics::Host`) implemented:
  * `alloc`: budget-check → delegate → record (handle→size in a private
    HashMap keyed by `(region_id, generation, offset)`).
  * `dealloc`: delegate → release the recorded size.
  * Everything else: pure delegation to the inner `SharedTvmHost`.
- Overrun surfaces as `TvmError::AllocationFailed` (existing variant) +
  a host-side `budget_overrun()` flag the embedder polls. No WIT change;
  guests see identical behaviour to substrate-wide exhaustion. The
  embedder reclassifies fatal-vs-graceful: substrate-wide exhaustion is
  still graceful (a restart can't free shared bytes); per-actor overrun
  is fatal-and-restartable (the new incarnation releases this actor's
  regions, so a restart actually remediates).
- `add_per_actor_to_linker<T: AsMut<PerActorTvmHost>>` mirrors
  `add_shared_to_linker` for the per-store wrapper.
- 5 unit tests in `per_actor::tests` cover: unlimited fast-path,
  budget-deny + overrun flag, dealloc-releases, reset_overrun, and the
  headline two-actors-share-substrate-independent-budgets case.

Pre-existing clippy warnings in `tvm-core` (introduced by recent Rust
1.96 lints) are *not* addressed here — out of scope, untouched files.
Existing tvm-wasm test suite stays fully green (87 tests across 20
binaries).

Author: Zachary Whitley

crates/tvm-wasmtime/src/lib.rs

@@ -47,6 +47,7 @@ pub mod imported;
 pub mod linker;
 pub mod macros;
 pub mod memory_factory;
+pub mod per_actor;
 pub mod prelude;
 pub mod raw_linker;
 pub mod region_view;
@@ -61,9 +62,11 @@ pub use imported::{
     build_imported_setup, build_imported_setup_with_data, create_imported_in_store, ImportedRegion,
 };
 pub use linker::{
-    add_concurrent_to_linker, add_shared_to_linker, add_to_linker, add_to_linker_with,
+    add_concurrent_to_linker, add_per_actor_to_linker, add_shared_to_linker, add_to_linker,
+    add_to_linker_with,
 };
 pub use memory_factory::{RuntimeMemoryRegion, WasmtimeMemoryRegion, WASM_PAGE_SIZE};
+pub use per_actor::{PerActorTvmHost, TvmBudget};
 pub use raw_linker::{
     add_raw_imports, add_raw_imports_with_memory_name, add_raw_shared,
     add_raw_shared_with_memory_name,

crates/tvm-wasmtime/src/linker.rs

@@ -4,6 +4,7 @@ use crate::bindings::tvm::memory::{bytes, diagnostics, manager, types};
 use crate::bindings::TvmGuest;
 use crate::concurrent_host::ConcurrentTvmHost;
 use crate::host::TvmHost;
+use crate::per_actor::PerActorTvmHost;
 use crate::shared_host::SharedTvmHost;
 
 /// Convenience wrapper for stores whose data implements `AsMut<TvmHost>`.
@@ -42,6 +43,21 @@ pub fn add_concurrent_to_linker<T: AsMut<ConcurrentTvmHost> + Send + 'static>(
     TvmGuest::add_to_linker::<T, HasSelf<ConcurrentTvmHost>>(linker, project::<T>)
 }
 
+/// Convenience wrapper for stores whose data implements
+/// `AsMut<PerActorTvmHost>`. Each store gets its own outstanding-bytes
+/// accounting + overrun flag, while the *inner* `SharedTvmHost` they
+/// each wrap stays a shared substrate — the right shape for embedders
+/// that host *untrusted* actors on a shared directory and want one to
+/// be unable to exhaust the substrate for the others.
+pub fn add_per_actor_to_linker<T: AsMut<PerActorTvmHost> + Send + 'static>(
+    linker: &mut Linker<T>,
+) -> wasmtime::Result<()> {
+    fn project<T: AsMut<PerActorTvmHost>>(state: &mut T) -> &mut PerActorTvmHost {
+        state.as_mut()
+    }
+    TvmGuest::add_to_linker::<T, HasSelf<PerActorTvmHost>>(linker, project::<T>)
+}
+
 /// Generic helper. Use when your store data isn't `AsMut<H>` directly — for
 /// instance when `T` is an application struct that owns the host alongside
 /// other state. Pass a `fn` pointer that projects from `&mut T` to `&mut H`.