ci: merge WASM build and release into main CI workflow

This ensures that a GitHub Release is only created/updated after tests succeed, attaching the WASM build alongside other assets.

Author: SamuelMarks

.github/workflows/ci.yml

@@ -3,10 +3,13 @@ name: CI
 on:
   push:
     branches: [ master, main ]
-    tags: [ 'v*.*.*' ]
+    tags: [ 'v*' ]
   pull_request:
     branches: [ master, main ]
 
+permissions:
+  contents: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -35,8 +38,17 @@ jobs:
       run: make test
     - name: Build
       run: make build
+    - name: Install binaryen
+      run: sudo apt-get update && sudo apt-get install -y binaryen
     - name: Build WASM
-      run: make build_wasm
+      run: |
+        make build_wasm
+        for f in bin/*.wasm; do
+          if [ -f "$f" ]; then
+            wasm-opt -O3 "$f" -o "$f" || true
+            cp "$f" dist/
+          fi
+        done
     - name: Upload Build Artifacts
       uses: actions/upload-artifact@v6
       with: