chore: fix wasm builds

flake.nix

@@ -36,6 +36,25 @@
       cargoNix = import ./Cargo.nix {
         inherit nixpkgs pkgs;
       };
+      # wasm-pack downloads wasm-bindgen and binaryen from GitHub releases
+      # unless they are on PATH, and its downloader ignores SSL_CERT_FILE, so
+      # behind the runners' TLS-auditing proxy those downloads fail (binaryen
+      # with no fallback). On PATH, it downloads nothing. wasm-pack only takes
+      # a PATH wasm-bindgen whose version equals Cargo.lock's `wasm-bindgen`,
+      # so this pin moves with the lock; CI checks that it does.
+      wasmBindgenCli = pkgs.buildWasmBindgenCli rec {
+        src = pkgs.fetchCrate {
+          pname = "wasm-bindgen-cli";
+          version = "0.2.128";
+          hash = "sha256-a7lcXJnnZkYReja+iUO7NqqrWyv3toxnUgQb8s4IS5s=";
+        };
+        cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
+          inherit src;
+          inherit (src) pname version;
+          hash = "sha256-R1Tas33Ursy8kqsxguAkG0ZhNed2n5uFTAhw1l2qlLY=";
+        };
+      };
+
       # Everything CI runs, and nothing else: `devShells.ci` is exactly this,
       # and the default shell is this plus editor and release tooling, so a
       # local `nix develop` runs the toolchain the checks run.
@@ -55,6 +74,8 @@
         # loadable page (improvise-d31). Must match WASM_PACK_VERSION in
         # scripts/web-toolchain-versions.env; CI checks that it does.
         pkgs.wasm-pack
+        wasmBindgenCli
+        pkgs.binaryen
 
         # NODE_VERSION's major, same check. The js and browser jobs ran 22
         # while `build` ran the pinned 24; one shell means one node.