wasmsign2_wrapper: hardcoded runfiles Rlocation breaks when consumed as a dependency

[avrabe]

tools/wasmsign2_wrapper/main.go locates wasmtime and the wasm component via hardcoded canonical runfiles paths:

r.Rlocation("+wasmtime+wasmtime_toolchain/wasmtime")
r.Rlocation("+_repo_rules+wasmsign2_cli_wasm/file/wasmsign2.wasm")

These canonical repo names are correct only when rules_wasm_component is the root module. When it's consumed as a dependency (e.g. git_override/bazel_dep from a downstream project), bzlmod prefixes the canonical name with rules_wasm_component+ → rules_wasm_component++wasmtime+wasmtime_toolchain, so Rlocation fails at runtime:

Wasmtime binary not found at .../wasmsign2_wrapper.runfiles/+wasmtime+wasmtime_toolchain/wasmtime

This is the same bug just confirmed for loom_wrapper in #490 (verified downstream in jess). wasm_sign / wasm_verify / wasm_keygen will fail for any downstream consumer. In-repo CI doesn't catch it because there rules_wasm_component is the root module.

Fix options

1. (matches the wasm_optimize: LoomOptimize action cannot find a fetched/symlinked input (wasmtime --dir=. preopen) #490 fix) Pass the wasmtime + wasm-component paths from the Bazel rule as arguments (stage them as action inputs), dropping the runfiles lookup. Cleanest; no repo-name dependency.
2. Use repo-mapping-aware resolution: Rlocation with the apparent repo name (wasmtime_toolchain/wasmtime) so the _repo_mapping translates it correctly in both root and dependency contexts.

Option 1 is what #490 (PR #497, commit f4eb4f8) adopted for loom_wrapper.

[avrabe]

Fixed in #503, mirroring the #497 approach: wasm_sign/verify/keygen now pass the wasmtime binary and wasmsign2 component as --bazel-wasmtime=/--bazel-wasm-component= args (staged as action inputs), and the wrapper no longer uses runfiles — so it's root/dependency-agnostic. Verified in-repo end-to-end: keygen+sign+verify build and verify_embedded reports "Signature is valid." Unlike the loom symlink case, the in-repo sign/verify chain fully exercises the wrapper runtime; the only thing it can't reproduce (the dependency repo-name prefix) is structurally eliminated.