Pin and snapshot Bun shell redirect buffers during async execution

Follow-up from #689 and the exact Bun shell fixture at checkout 4982b91.

Remaining unchanged-suite failures:

• redirect target buffer stays attached while a builtin command is running
• stdin redirect from a Uint8Array sends the bytes captured when the command starts
• output redirect buffer for an external command stays attached until the command finishes

Port Bun ownership semantics so output buffers stay pinned for the full async command lifetime and input bytes are snapshotted before user code can transfer or mutate the backing ArrayBuffer. Do not weaken the tests or replace ownership with timing-dependent behavior.

Strict baseline after e83b67b: 369 pass, 83 upstream TODO, 9 fail across 461 tests. Related trackers: #66 and #202.

Resolved on main by 0bc37d2. ArrayBuffer stdin redirects now snapshot owned bytes when execution starts. Output redirects now materialize and pin their backing ArrayBuffer against transfer, remain GC-rooted, and balance the pin during strong-buffer cleanup for builtin and external command paths. All three unchanged upstream regressions pass, including attempted transfer while a writer is active and mutation after stdin capture. The full 461-test fixture was repeated twice at 377 pass / 83 todo / 1 fail.