WASM isn't a magic bullet for sandboxing. CI environments assume a full Linux. So you need to either ran a VM (with the attack surface that implies) or a write an x86 emulator in WASM (which would be very slow).
You also need anti-abuse to stop bitcoin miners from using your system. GitHub probably have full-time employees working on it.
> Like bitcoin mining, there could be some competition between 3 parallel builds to pick the winner if the output is the same.
It's a lot more complicated because many builds are not deterministic, you need to store artefacts, build secrets, etc.
Companies like golem.network or iex.ec have been working on this problem for a decade and they are still not easy to use.