[dgageot]

Why

RAG support in the WASM build was always wired in, pulling in its dependencies
and validation logic unconditionally even when a config didn't use it.

What

• RAG is now off by default in the WASM runtime and opt-in via the
  docker_agent_wasm_rag build tag/flag.
• RAG wiring and validation moved behind a compile-time boundary so the
  default WASM build excludes it entirely.
• Decoupled the documents input handling from RAG so it can be used
  independently.
• Configs that reference unsupported/disabled features are now strictly
  rejected instead of silently ignored.
• Added dependency guards to keep RAG-specific deps out of the default build.
• Added JS, Go, and browser tests covering both the default and RAG-enabled
  builds.
• Updated docs to reflect the opt-in behavior.

Native (non-WASM) runtime behavior is unchanged.

Validation

• task build, task test, task lint (with CI=true)
• Targeted GOOS=js lint for both default and RAG builds
• task test-wasm-js, task test-wasm-bridge, task test-wasm-browser (13 browser checks)
• Focused e2e dependency tests, plus cloud+RAG Go/WASM tests
• Syntax/whitespace checks