Scaffold vpinball-wasm: Emscripten port of Visual Pinball

Build scripts, CMake/source patches, npm packaging, and a Gitea CI
workflow to compile the real Visual Pinball engine (SDL3 + WebGL2 +
libwinevbs for real VBScript) to WebAssembly.

The patches are validated end-to-end: the patched engine boots in a
real browser, loads a real .vpx table, compiles its real GLSL shaders,
computes environment map radiance, initializes physics, and starts the
VBScript engine, before hanging on the one deliberately-deferred piece
of work (game loop rewrite around emscripten_set_main_loop), documented
in the README's roadmap.

scripts/versions.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Single source of truth for every pinned version/commit this project builds
+# against. Sourced by every other script in this directory and used to derive
+# CI cache keys. Keep these in sync with the upstream vpinball checkout's own
+# platforms/config.sh - do not drift silently.
+
+# Pinned to the exact commit already researched/verified in
+# /home/valknar/Projekte/vpinball-rust/repos/vpinball (HEAD as of 2026-08-21).
+VPINBALL_SHA=195f214dd4849b8ef6113fd377258b78d0dec3bf
+
+# Pinned to the exact commit already validated end-to-end by the
+# libwinevbs-wasm spike (compiles + runs real VBScript under Emscripten).
+# This matches vpinball's own platforms/config.sh LIBWINEVBS_SHA exactly.
+LIBWINEVBS_SHA=bcc790e58d394b282c327feca2a7c921ca022e8d
+
+# Mirrors vpinball's platforms/config.sh pins, so this project's wasm build
+# stays close to what every other vpinball platform actually ships.
+SDL_SHA=147a8ee32dbf9ac02f3794964490687b6bbda1bc
+SDL_IMAGE_SHA=bec9134a26c7d0f31b36d6083c25296e04cabff5
+SDL_TTF_SHA=a1ce3670aec736ecbf0936c43f2f0cc53aa61e5b
+FREEIMAGE_SHA=b1613452a0c3849d43ac877b154cf51ff9e078d3
+
+# Emscripten SDK version already validated by both spikes
+# (spikes/libwinevbs-wasm and spikes/sdl3-gles3-wasm).
+EMSDK_VERSION=6.0.8
+
+# Matches libwinevbs's `find_package(BISON 3.8.2 REQUIRED)`.
+BISON_MIN_VERSION=3.8.2