ci: fix maturin and wasm-pack jobs

Two unrelated failures in the post-release CI run:

- Python jobs: `maturin develop` requires an activated virtualenv on
  CI runners that don't have a system Python set up that way. Switch
  to `maturin build --release --out dist` followed by `pip install
  --find-links dist`, which is venv-agnostic and OS-portable.

- WASM job: the wasm-opt bundled with wasm-pack is older than the WASM
  features rustc 1.92 enables by default. The fix is to opt every feature
  in explicitly via the package metadata — reference-types, multivalue,
  bulk-memory, sign-ext, mutable-globals, nontrapping-float-to-int — so
  wasm-opt accepts the input.

Same code as before; only the build steps and the wasm-opt config changed.

bindings/wasm/Cargo.toml

@@ -35,4 +35,16 @@ default = []
 panic-hook = ["dep:console_error_panic_hook"]
 
 [package.metadata.wasm-pack.profile.release]
-wasm-opt = ['-O3', '--enable-bulk-memory']
+# The wasm-opt that ships with wasm-pack is older than the WebAssembly
+# features rustc enables by default (reference-types, multivalue,
+# bulk-memory, sign-extension, mutable-globals, …). Listing them all keeps
+# wasm-opt happy without requiring a binaryen upgrade in CI.
+wasm-opt = [
+    '-O3',
+    '--enable-bulk-memory',
+    '--enable-mutable-globals',
+    '--enable-nontrapping-float-to-int',
+    '--enable-sign-ext',
+    '--enable-reference-types',
+    '--enable-multivalue',
+]