ref.test and ref.cast accept a target heap type from a different hierarchy than the operand

ref.test and ref.cast validate (and run) with a target heap type that is in a different type hierarchy than the operand — e.g. ref.test (ref extern) / ref.cast (ref extern) applied to an (ref i31) value. The spec requires the target reference type and the operand type to share a common top (the same hierarchy: any / func / extern), so these modules are ill-typed; wasm-tools, V8 and wasmtime all reject them at validation, but Wizard accepts and runs them.

Minimal repros

;; ref.test — accepts, and returns a (wrong) positive result
(module (func (export "f") (result i32)
  (ref.test (ref extern) (ref.i31 (i32.const 5)))))     ;; Wizard: 1   conformant: REJECT

;; ref.cast — accepts, then runs (or runtime-traps FAILED_CAST)
(module (func (export "f") (result i32)
  (drop (ref.cast (ref extern) (ref.i31 (i32.const 5)))) (i32.const 7)))   ;; Wizard: 7   conformant: REJECT

Scope

• Affects the ref.test / ref.cast pair. br_on_cast and br_on_cast_fail correctly reject the same cross-hierarchy operands at validation, so the missing check is localized to ref.test / ref.cast.
• Same-hierarchy controls validate and run correctly on every engine: ref.test (ref i31) on an (ref i31) value → 1.

Per the spec, ref.test rt / ref.cast rt are well-typed only if the operand's type and rt have a common supertype (the test/cast is within one hierarchy); a cross-hierarchy test/cast is unrepresentable and must be rejected at validation.

Start with the validation handling for the ref.test and ref.cast instructions and run the minimal repro modules from the issue. Add coverage for cross-hierarchy operands such as (ref extern) with (ref i31), and consider the work done when both instructions reject these modules while same-hierarchy cases continue to validate.