Add WASIX / WebAssembly sandbox backend support

### Description of the new feature / enhancement

Currently, Microsoft Execution Containers (MXC) provides policy-driven containment through native OS primitives (`ProcessContainer` on Windows, `Bubblewrap` on Linux, `Seatbelt` on macOS) and virtualization (`MicroVM`/`Hyperlight`).

While OS-native and VM backends excel at isolating traditional process executions, they can introduce startup overhead when handling high-frequency, short-lived AI agent tool calls or require OS-specific kernel capabilities. Additionally, WebAssembly (specifically WASIX) is rapidly becoming a standard runtime target for sandboxing untrusted dynamic code generation and plugin execution across heterogeneous environments.

### Proposed technical implementation details

Introduce a `wasix` (or `wasm`) backend option within MXC (`wxc-exec` / TypeScript SDK `@microsoft/mxc-sdk`).

The WASIX backend would leverage a WebAssembly runtime (such as Wasmer or Wasmtime extended with WASIX support) to execute WebAssembly binaries or WASI/WASIX-compiled runtimes (like Python WASM) under MXC policy constraints.

#### Key Aspects:
1. **Schema Extension:** Extend the JSON policy schema to support `wasix` as a backend target:
```json
{
"script": "app.wasm",
"backend": "wasix",
"wasix": {
"runtime": "wasmer",
"entrypoint": "_start"
},
"filesystem": {
"readwritePaths": ["/tmp/workspace"],
"readonlyPaths": ["/usr/lib"]
},
"network": {
"defaultPolicy": "block",
"allowedHosts": ["api.github.com"]
}
}