feat(v1): harden typed runtime boundaries

Elect one canonical EffectBatch codec, remove the parallel postcard API, and strengthen fail-closed host, form, sync, WASM, macro, generated-contract, and test-harness proofs with mutation-driven coverage.

req: wire/008

req: wire/009

req: wire/010

req: push/008

req: client_local/015

req: client_local/016

req: client_local/017

req: client_local/018

req: client_local/019

req: sync/024

req: sync/025

req: sync/026

req: sync/027

req: sync/028

req: sync/029

req: test/020

req: test/021

hemx-core/src/lib.rs

@@ -451,7 +451,7 @@ pub enum Effect {
     },
 }
 
-#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[derive(Clone, Debug, Eq, PartialEq)]
 pub struct EffectBatch {
     pub abi_version: u32,
     pub fingerprint: BuildFingerprint,
@@ -459,6 +459,13 @@ pub struct EffectBatch {
 }
 
 impl EffectBatch {
+    /// The versioned hemx codec is the sole public `EffectBatch` wire API.
+    ///
+    /// ```compile_fail
+    /// let batch = hemx_core::EffectBatch::new(hemx_core::BuildFingerprint(1));
+    /// let _ = batch.to_postcard();
+    /// ```
+    /// req: wire/010 test
     /// Return the exact number of bytes produced by [`Self::to_wire`].
     pub fn encoded_len(&self) -> usize {
         batch_wire_len(self)
@@ -478,14 +485,6 @@ impl EffectBatch {
         read_batch(bytes)
     }
 
-    pub fn to_postcard(&self) -> Result<Vec<u8>, postcard::Error> {
-        postcard::to_allocvec(self)
-    }
-
-    pub fn from_postcard(bytes: &[u8]) -> Result<Self, postcard::Error> {
-        postcard::from_bytes(bytes)
-    }
-
     pub const fn is_compatible(&self) -> bool {
         self.abi_version == EFFECT_BATCH_ABI_VERSION
     }
@@ -770,12 +769,9 @@ impl<'a> WireReader<'a> {
     }
 
     fn read_exact(&mut self, len: usize) -> Result<&'a [u8], WireError> {
-        let end = self.offset.checked_add(len).ok_or(WireError::Truncated)?;
-        if end > self.bytes.len() {
-            return Err(WireError::Truncated);
-        }
-        let bytes = &self.bytes[self.offset..end];
-        self.offset = end;
+        let remaining = &self.bytes[self.offset..];
+        let bytes = remaining.get(..len).ok_or(WireError::Truncated)?;
+        self.offset += len;
         Ok(bytes)
     }
 }