Since WASM blobs would run in the end-user's browser, GPL is sufficient to allow the user to request source. AGPL is more useful for preventing e.g. cloud build services.

AGPL contrains the rights of the user. That's its job. The whole point is to be GPL, which prevents users from distributing modifications to the original program, with the addition of preventing users from offering their modifications as a service over the Internet.

MIT, Apache, and BSD have none of those restrictions on users. How is APL the "least restrictive"?

Please read the AGPL very carefully before saying things like this. There is no reasonable interpretation where some cli program in part of a CI pipeline would infect the result of the pipeline (i.e. build artifacts) unless it actually put itself into the result. (E.g. gcc puts a small amount of code from libgcc into the executable, but that explicitly has a different license).

The "A" of the AGPL expands the distribution rules of the GPL to include network access but doesn't really expand the virality or combined-works parts. It "infects" your program just as much as any GPL program would.