[interp] Fix wasm-interp stack cleanup for tail calls

[KKiiim]

Summary

Fix incorrect value-stack cleanup when lowering return_call and return_call_indirect in wasm-interp.

The interpreter emits drop_keep before a tail call to discard values below the callee arguments. The cleanup counts must be calculated from the validator's current type stack. Previously, the return-call validator was invoked before that calculation, consuming the tail-call operands and making the computed drop count incorrect.

As a result, dead operand-stack values could survive an imported tail call and later be observed as a caller result.

Fix

Get the callee parameter count from the validator, then compute drop_keep and catch cleanup before validation consumes the operands. Invalid indexes remain handled by the validator.

Tests

Add minimal direct and indirect imported tail-call regressions where a dead value below the tail-call arguments must not escape into the caller.
Verified with the focused interpreter tail-call tests and the original fuzz reproducer, which now returns i32:0.

[sbc100]

Why pull this information from the validator if we have our own func_types_ array?

IIUC that validator is not normally the source of this kind of information is it?

[sbc100]

Can you add a comment as to why we have this early return when param count is zero? Can't the generic code below handle zero params?

[KKiiim]

Yes. Thanks for your advice.

Current change: Compute and emit the correct drop_keep cleanup before validation consumes the tail-call arguments.

This bug can be reproduced using the function f. f should return 0, not 777.

(module
  (type $i_i (func (param i32) (result i32)))
  (import "host" "print" (func $imported (type $i_i)))

  (func $tail (result i32)
    i32.const 777
    i32.const 0
    return_call $imported)

  (func (export "f") (result i32)
    (local i32)
    call $tail
    local.get 0
    return)
)