Exception Reference Global Panics Coredump Serialization

## Summary

When WebAssembly coredump capture is enabled, an untrusted module containing a valid `exnref` global can turn an ordinary guest trap into a Rust panic in the host. Coredump serialization assumes every reference type belongs to the external, function, or `anyref` families; the exception-reference family reaches an `unreachable!()` arm instead of being encoded or rejected.

## Detail

After the guest traps, `WasmCoreDump::_serialize` recreates module globals in the core dump. For reference-valued globals it calls `r.heap_type().top()` and handles only `Extern`, `Func`, and `Any`:

```rust
ValType::Ref(r) => match r.heap_type().top() {
HeapType::Extern => wasm_encoder::ValType::EXTERNREF,
HeapType::Func => wasm_encoder::ValType::FUNCREF,
HeapType::Any => wasm_encoder::ValType::Ref(wasm_encoder::RefType::ANYREF),
ty => unreachable!("not a top type: {ty:?}"),
},
```

The exception-reference top type is `Exn`, so a mutable `exnref` global reaches the final arm. The reproducer enables the existing coredump option and invokes an exported function containing `unreachable`; no harness or source change is involved.

## Reproduce

```sh
set -eu
git clone --depth 1 https://github.com/bytecodealliance/wasmtime.git
cd wasmtime
git rev-parse HEAD

cargo build --bin wasmtime --no-default-features \
--features 'run,wat,cranelift,compile,coredump,clap/default,clap/wrap_help'

cat > exnref-coredump.wat <<'WAT'
(module
(global (export "g") (mut exnref) (ref.null exn))
(func (export "trap")
unreachable))
WAT

set +e
RUST_BACKTRACE=0 ./target/debug/wasmtime run -D coredump=guest.dump \
--invoke trap exnref-coredump.wat
status=$?
set -e
printf 'exit=%s\n' "$status"
```

Observed output on the affected HEAD:

```text
3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb

thread 'main' (...) panicked at crates/wasmtime/src/runtime/coredump.rs:194:31:
internal error: entered unreachable code: not a top type: Exn
exit=101
```