cli: fix wasm hot-patch fat builds with wasm-bindgen 0.2.128 / Rust beta (Playwright CI)

[nicoburns]

Summary

The web-hot-patch / web-hot-patch-fullstack Playwright fixtures fail to build in CI. Two independent causes, one commit each.

cli: drop -Clink-dead-code for wasm hot-patch builds

wasm-bindgen ≥ 0.2.128 discovers generic-import / wbg_cast descriptors by scanning every local function for a direct call to the __wbindgen_describe_generic_import import and interpreting that function as a descriptor. Its shims reach the import through the #[inline(always)] wasm_bindgen::describe::describe_generic_import wrapper, which is assumed to never exist as a real wasm function.

The fat build passes -Clink-dead-code to the final crate. Besides its linker effect, that flag makes rustc emit #[inline] functions as one shared instantiation per crate instead of a local copy per CGU, so at opt-level=0 calls from other CGUs can't be inlined. The wrapper survives out-of-line, wasm-bindgen "interprets" it with no payload → index out of bounds panic in decode_generic_import. Reproduces on stable as well as beta (the stable Playwright job was skipped on #5842, which made it look beta-only).

On wasm the flag isn't needed for retention: that comes from --no-gc-sections + --whole-archive, and prepare_wasm_base_module promotes the symbol table to the indirect function table itself. Native targets keep it — patches resolve against the base binary's exported symbols, and dropping it there breaks the fullstack server patch with dlopen: undefined symbol ….

// request.rs, hot-patch cargo args
cargo_args.push("-Csave-temps=true");
if !is_wasm {
    cargo_args.push("-Clink-dead-code");
}

Bump walrus 0.23 -> 0.26 and wasmparser 0.235 -> 0.245

Rust beta emits Wasm exception-handling constructs (tag imports) in the fullstack client build; walrus 0.23 fails with exceptions proposal not enabled. Bumps walrus → 0.26.5 and wasmparser → 0.245.1 (with matching id-arena/rayon minimums for the min-versions check) and adapts the small API changes in assets.rs, wasm-split-cli, wasm-used.

Verification

RUSTUP_TOOLCHAIN={beta,stable} npx playwright test web-patch.spec.js web-patch-fullstack.spec.js → 2 passed on both toolchains; patch jump-table sizes identical to before. cargo +1.94.0 clippy -p dioxus-cli -D warnings clean.

Link to Devin session: https://dioxus.staging.devinenterprise.com/sessions/772e28e3f6d84ac1925da7ddfc952d2d
Open in Devin Desktop: https://dioxus.staging.devinenterprise.com/desktop/session/772e28e3f6d84ac1925da7ddfc952d2d?variant=devin-insiders
Requested by: @nicoburns

[staging-devin-ai-integration]

I'll fix CI failures and address comments from users with write access that start with 'DevinAI' or '@devin'.

• Disable automatic comment, CI, and merge conflict monitoring

[LucaCappelletti94]

I would request changes, but I can only comment.