VM: quicken guarded dense array creation

Parent: #498 Related: #1048, #1050, #1051, #493

Measured problem

An executed VM counter witness confirms that three semantically ordinary Array stores—appending index 0, filling a hole, and growing a nearby dense gap—produce correct results while the dense-store quick-path counter remains unchanged in both isolated and shared dispatch modes. They fall through to generic [[Set]] even though the interpreter already owns a guarded, prototype-aware dense creation primitive.

Scope

• Reuse the existing guarded Array dense-index mutation primitive from VM set_index.
• Cover append, hole fill, and bounded nearby dense growth for primitive Number and canonical String array-index keys.
• Preserve Array length, holes, extensibility, non-writable length/index descriptors, inherited setters/non-writable indexed data, Proxies, accessors, restriction ownership, and shared synchronization.
• Leave distant sparse-property creation and observable/generic key coercion on ordinary [[Set]].
• Add a dedicated hit counter and update the source-derived quickening inventory and generated architecture page.

Acceptance

• The pre-change zero-hit witness records positive dense-creation hits with identical Node results.
• Append, hole fill, bounded gap growth, and canonical String keys are pinned in isolated and shared modes.
• Prototype interceptors, descriptors, non-extensible Arrays, Proxies, sparse creation, and object/non-canonical keys stay generic.
• Restriction ownership and unsuppressed TSan coverage pass.
• Quickening inventory, benchmark-validator, docs-manifest, and offline-link gates pass.

Implemented and pushed in ebdbf6a.

VM set_index now reuses the existing guarded dense-index mutation primitive for append, hole fill, and bounded nearby growth. Primitive Number and canonical String keys are eligible. Distant sparse creation, observable key coercion, receiver descriptors, non-extensibility, Proxies, and prototype interceptors continue through ordinary [[Set]].

Measured evidence:

• The pre-change witness recorded zero dense-creation hits; the completed test records at least four hits in each isolated/shared mode.
• The 13-case behavior matrix matches Node exactly.
• Behavior and receiver/prototype restriction tests each pass 2/2 in normal and unsuppressed TSan builds.
• Neighboring packed dense, sparse store, and canonical String quickening tests pass 2/2 each.
• Quickening inventory: 17 guarded families, 5 unsupported families, and 40 observability counters.
• Aggregate benchmark validators: 19/19.
• Documentation: 51 pages generated and all 378 offline links resolve.

The test262 corpus is unavailable in this checkout, so no conformance-flip claim is made.