jsoo: honor build_runtime_flags when the shared standalone runtime is used

[hhugo]

Since #13621 (workspace-shared standalone runtimes, released in 3.23.0), an executable in separate compilation mode that has no javascript_files/wasm_files of its own is always given the shared runtime — and the shared runtime is built by setup_shared_runtime_rule with In_context.default.flags. The stanza's (js_of_ocaml (build_runtime_flags ...)) are silently dropped: nothing is emitted at build time, and e.g. a --file %{dep:data.txt} pseudo-filesystem embed simply doesn't happen, breaking Sys_js.read_file at run time.

Minimal reproduction (first commit adds it as a cram test, recording the buggy output):

$ cat dune
(executable
 (name main)
 (modes js)
 (js_of_ocaml
  (compilation_mode separate)
  (build_runtime_flags (:standard --file %{dep:data.txt}))))
$ dune build ./main.bc.js && grep -c EMBEDDED_PAYLOAD _build/default/main.bc.js
0        # expected 1; the build-runtime command contains no --file

Adding a dummy (javascript_files extra.js) to the very same stanza — which disqualifies it from sharing — makes the flags take effect again, isolating the sharing path as the cause.

The fix (second commit) makes sharing eligibility also require that the stanza's build_runtime_flags spec is the default (:standard); otherwise the executable falls back to the per-stanza standalone runtime, where its flags apply as before 3.23. Executables with default flags keep sharing (the test's second half checks a single shared runtime is still produced).

Known limitation, unchanged by this PR: build_runtime_flags customized through an (env ...) stanza are still not reflected in the shared runtime, which is built with the flags of the workspace root. Fixing that would require either including expanded flags in the runtime key or comparing env nodes; both seemed better discussed separately.

Found in the wild: js_of_ocaml's own examples embed data files via --file and silently broke (blank canvas); see ocsigen/js_of_ocaml#2388 which now also ships the files over http as a workaround.

[hhugo]

@vouillon, do you have time to look at this ? Test and fix were fully generated by AI assistant.

[hhugo]

@vouillon gentle ping

[Alizter]

@hhugo The doc commit is missing DCO.

[Alizter]

I'd like to proceed with the release, so I will waive the DCO for the changelog entry commit here and add one myself in the backport.