Complete the ChildTyper migration of validator child-type checks

Start with src/wasm/wasm-validator.cpp and src/ir/child-typer.h, then run the coverage diff described in the issue for each remaining validator method. Migrate methods whose child-type cases match, document methods dominated by non-child checks, and extend ChildTyper first when validator cases are missing; run python3 check.py lit and repeat the coverage diffs for each batch.

Problem:

#6613 migrated four methods (visitUnary, visitBinary,
visitRefIsNull, visitRefEq) to a ValidatorTypeChecker subclass of
ChildTyper. Roughly 70 methods with ChildTyper counterparts
remain unmigrated. The issue's stated goal — "Using ChildTyper
would delete code and improve correctness" — is partially
achieved.

Migrated (4):
visitUnary, visitBinary, visitRefIsNull, visitRefEq.

Blocked by sharedness (2), see the sibling issue:
visitI31Get, visitCallRef.

Deliberately skipped, with reasoning:
SIMD family (7 methods). Switch is dominated by immediate
validation (lane index range), memory helpers (validateOffset,
validateAlignment), and result-type computation. At most one
child-type check per method; migration would add a cross-file
dependency without code reduction.
Tuple family (visitTupleExtract, visitTupleMake). Result-type
checks, not child-type checks.
visitRefI31, visitRefAs. Feature-gate switches with one
migratable child-type check apiece.

Not yet examined:
visitCall, visitCallIndirect visitStructGet, visitStructSet, visitStructRMW, visitStructCmpxchg, visitStructWait visitArrayNew, visitArrayNewData, visitArrayNewElem, visitArrayNewFixed, visitArrayGet, visitArraySet, visitArrayLoad, visitArrayStore, visitArrayLen, visitArrayCopy, visitArrayFill, visitArrayInitData, visitArrayInitElem, visitArrayRMW, visitArrayCmpxchg visitStringNew, visitStringMeasure, visitStringEncode, visitStringConcat, visitStringEq, visitStringTest, visitStringWTF16Get, visitStringSliceWTF visitContNew, visitContBind, visitSuspend, visitResume, visitResumeThrow, visitStackSwitch visitTryTable, visitThrow, visitThrowRef visitBrOn, visitRefTest, visitRefCast, visitRefGetDesc visitDrop, visitReturn, visitMemoryGrow visitTableGet, visitTableSet, visitTableGrow, visitTableFill, visitTableCopy, visitTableInit visitMemoryInit, visitMemoryCopy, visitMemoryFill visitAtomicRMW, visitAtomicCmpxchg, visitAtomicWait, visitAtomicNotify
and others.

Proposed approach: For each remaining method, run the same
coverage diff that #6613 used:

git show HEAD:src/wasm/wasm-validator.cpp \
  | awk '/^void FunctionValidator::visitM(/{p=1} p{print} p && /^}/{exit}' \
  | grep -oE 'case [A-Za-z0-9_]+:' | sort -u > /tmp/val.txt
sed -n '/void visitM(/,/^  }/p' src/ir/child-typer.h \
  | grep -oE 'case [A-Za-z0-9_]+:' | sort -u > /tmp/ct.txt

diff /tmp/val.txt /tmp/ct.txt

If the diff is empty, migrate. If the method's switch is dominated
by non-child checks, skip and document. If the diff is non-empty
in the validator direction, ChildTyper is missing opcodes and
must be extended first.

Verification per batch: python3 check.py lit, plus the coverage
diff for each migrated method.

Follow-up: Batch 2 of this work is the array and struct accessor
families, which are structurally similar and likely share a
common migration pattern.

Refs #6613.