fix(wasm): boot real firmware past allocator and signature crashes

Drop EMULATE_FUNCTION_POINTER_CASTS (it broke the wasm32 TCG ffi_call_js
path with BigInt errors) and fix the underlying function-pointer signature
mismatches instead: object_class_cmp GCompareFunc, esp_sha hash-callback
wrappers, and an xts_aes NULL guard in the ESP32-C3 cache. Backport the
upstream Emscripten anonymous-RAM allocator fix. Firmware now boots and
initializes the X3 panel; a post-init boot stall remains.

HANDOFF.md

@@ -265,9 +265,16 @@ ADC ladders on GPIO1 & GPIO2; power button GPIO3; UC8253 @ 16 MHz.
   `-sEMULATE_FUNCTION_POINTER_CASTS=1` is required for QEMU's QOM callbacks.
 - The WASM dependency image omits libgcrypt. AES/RSA/DS/XTS devices are therefore
   not instantiated; their MMIO falls through to the existing zero-return stub.
-- Real firmware currently stops in `ffi_call_js`: Emscripten's
-  `EMULATE_FUNCTION_POINTER_CASTS` conflicts with libffi/BigInt. The paused
-  machine and browser bridge smoke tests pass; full browser boot does not yet.
+- Real firmware now boots past the earlier crashes and initializes the X3 panel.
+  It stalls before painting a full home screen (display generation freezes at 2
+  after early init) — the next investigation, likely timer/interrupt or slow TCG.
+- Function-pointer signature fixes (required after dropping
+  `EMULATE_FUNCTION_POINTER_CASTS`, which broke the wasm32 TCG `ffi_call_js`
+  path): `object_class_cmp` → `GCompareFunc`, `esp_sha` hash-callback wrappers,
+  and an `xts_aes != NULL` guard in the ESP32-C3 cache (XTS is gcrypt-gated and
+  absent in WASM; unencrypted flash is unaffected).
+- Emscripten pthread startup has a rare transient trap at proxied entry
+  (`invokeEntryPoint` → `dynCall_ii`); the build retries the bridge smoke once.
 - The upstream Emscripten RAM allocator fix is backported: anonymous guest RAM
   uses `qemu_memalign` instead of the broken partial-unmap `mmap` workaround.
 - Emscripten pthreads require cross-origin isolation (COOP/COEP) in the browser.