Byte-based verification entry point for non-browser runtimes (Node, Cloudflare Workers, Deno) #147

Problem

The only verification entry points on WasmReader are fromBlob /
fromBlobFragment, which read input through FileReaderSync — a
WorkerGlobalScope-only API. createC2pa in c2pa-web additionally
requires the Worker constructor. Neither exists in server-side /
edge runtimes (Node, Cloudflare Workers workerd, Deno, Bun), which
makes C2PA verification currently impossible outside a browser, even
though the underlying wasm (with rust_native_crypto) has no browser
dependency for the crypto itself.

Context: we run pay-per-call utility APIs for AI agents on Cloudflare
Workers (402utils.com) and want to offer Content Credentials
verification — especially relevant with the EU AI Act Art. 50
transparency obligations applying from 2026-08-02.

Proposal

Add a fromBytes(format: string, bytes: Uint8Array, settings?)
sibling to fromBlob, feeding the existing private
WasmReader::from_stream helper a Cursor<Vec<u8>> instead of a
BlobStream. ~15 lines, no new dependency, no browser API, identical
return type and validation behavior.

Evidence

We have this working: verified 5 cases (valid manifest, no manifest,
corrupted claim, corrupted signature, corrupted asset bytes) with
byte-identical results between Node and real workerd (wrangler dev).
All tampering is correctly detected; getRandomValues resolves via
globalThis.crypto; no hidden browser-API layer appeared.

A PR is ready on my fork (feat/wasm-reader-from-bytes: method + two
wasm_bindgen_tests + signed fixture + changeset) — happy to open it
if this direction works for you. CLA signed.

Note: this touches the same files as #137 (BlobStream perf); I'll
rebase as needed.