Deduplicate shared validation in the WASM and WASI smoke runners

## Problem

`tools/run_wasm_smoke.mjs` and `tools/run_wasi_smoke.mjs` have different runtime-specific behavior, but they duplicate small pieces of WebAssembly module loading and export validation. The private `__wave_` export check is implemented separately in both scripts, so future changes can drift.

## Scope

Extract only the common smoke-runner helpers into a small shared module.

Keep browser-specific assertions such as `wave_add`, `wave_features`, `main`, and exported memory in `run_wasm_smoke.mjs`. Keep WASI setup, preopens, imports, and `wasi.start()` in `run_wasi_smoke.mjs`.

Do not merge the two entry points or introduce a general WebAssembly runtime abstraction.

## Completion criteria

- [ ] Both runners use the same private-export validation helper.
- [ ] Common module-loading code is shared where it does not change runner behavior.
- [ ] Browser-specific and WASI-specific checks remain in their current entry points.
- [ ] Existing command-line usage and success/failure behavior remain unchanged.
- [ ] Existing WebAssembly CI continues to pass.

Related: #643

Start by comparing tools/run_wasm_smoke.mjs and tools/run_wasi_smoke.mjs, focusing on duplicated module-loading and private __wave_ export validation. Keep browser assertions and WASI setup in their existing entry points; done means both runners share only the common helpers, preserve their command-line behavior, and pass the existing WebAssembly CI.

Written by the indexing model from the issue text.