Compile the Component bytes that Runtime admitted #431

Runtime must compile the same Component bytes that passed signature and import checks. The current path reads the entrypoint during admission, reads it again for import validation, and reads it again through Component::from_file. A file replacement between these reads can change the bytes that execute.

This is the requested follow-up from #416. Its compilation queue fix does not close this byte-identity gap.

Done means:

• Runtime admits one immutable byte buffer under the existing signature, import and capability rules.
• Import validation and Component::from_binary consume that same buffer.
• A deterministic file-replacement test proves that changing the path after admission cannot change the compiled bytes. Reverting buffer reuse makes the test fail.
• Denied imports, invalid signatures and compilation errors retain their existing failure behavior. Review memory and lifetime bounds.

Acceptance record:

• Candidate: pending.
• Exercised checks: issue only; implementation tests pending.
• Review links: follow-up requested in Keep Component compilation off async workers and limit slot waits #416.
• Installed release evidence: pending.
• Remaining gate: implementation, regression and tamper proof, required independent reviews and installed acceptance.
• Next owner: Component admission/compute owner, unassigned.