VM: quicken numeric arguments-object access

Parent: #498 Related: #1045, #1046, #493

Problem

VM get_index / set_index specialize dense Arrays and primitive-Number TypedArray keys, but numeric access to mapped and unmapped arguments objects still allocates a property-key string and re-enters generic indexed-property dispatch. Primitive Number keys have no observable key coercion, while the arguments object already exposes atomic mapping helpers and synchronized dense-element operations.

A pre-fix VM witness matches Node for sloppy parameter aliasing in both directions, mapping severance after delete/redefinition, strict unmapped arguments, numeric -0, negative named properties, object-key coercion, and indexed accessors. Both test-only arguments fast-hit counts remain zero.

Scope

• Add guarded VM numeric get_index and set_index paths for direct arguments objects.
• Preserve live sloppy parameter mapping, strict/unmapped behavior, delete/redefinition severance, indexed accessors/attributes, holes, and restriction checks.
• Keep string, Symbol, object, invalid numeric, sparse, and prototype-observable cases on full property semantics.
• Use existing atomic mapping and synchronized dense-element helpers; do not duplicate arguments semantics.
• Update the source-derived quickening inventory and generated architecture page.

Acceptance

• The pre-fix witness changes both read and store counters from zero to positive with identical Node results.
• Mapped/unmapped, severed mapping, numeric -0, negative/object keys, and accessor overrides are pinned.
• Focused normal and unsuppressed TSan tests pass.
• Quickening inventory, benchmark-validator, docs-manifest, and offline-link gates pass.
• No key-source recognizer, generic fallback bypass, or unsynchronized mapping/element access.

Implemented in 360c1ea.

Primitive Number keys now use guarded VM paths for direct mapped and unmapped arguments objects. Mapped reads and stores retain the live parameter cells; severed and strict indices use synchronized dense storage. Accessors, non-writable attributes, object/string keys, negative named properties, and other observable cases continue through the generic property algorithms. Restriction ownership is checked before either fast path.

Validation:

• the pre-fix witness had zero read/store hits; both counters are now positive
• the full edge matrix matches Node
• focused VM tests: 36/36 normal
• focused numeric-arguments tests: 3/3 under unsuppressed TSan
• quickening inventory: 17 guarded, 5 unsupported
• benchmark harness self-tests: 19/19
• docs: 51 pages with the exact manifest and 378 valid offline links

The test262 corpus is absent from this checkout, so this change makes no conformance flip claim.