VM: preserve Array length during sparse creation

Parent: #498 Regression from: #1053 / 14ec355

The VM sparse-creation fast path reduces Array length when a new distant index is below the current sparse length.

Executed reproduction:

let values = [];
values[2000000] = 1;
values[1000000] = 2;
values.length;

Node: 2000001. Current forced VM: 1000001; the focused regression test fails with that exact difference.

createSparseArrayOwnData assigns index + 1 directly to the length floor instead of preserving the existing floor. Array exotic [[DefineOwnProperty]] only increases length for a new index at or above the existing length.

Acceptance:

• Preserve the maximum of old Array length and the created index plus one under the existing element lock.
• Pin descending Number/String indices, pre-sized Arrays, unchanged high-index reads, and the maximum Array index in isolated/shared dispatch modes.
• Focused normal and unsuppressed TSan tests and neighboring sparse-array tests pass.

Fixed in 4cd0601.

Sparse creation now preserves max(old length floor, index + 1) while holding the existing element lock. The executed failing case changed from 1000001 to Node's 2000001.

Four Node-confirmed cases pin descending Number/String keys, pre-sized Arrays, retained high-index data, canonical enumeration, and index 4294967294. The sparse test suite passes 14/14 normally and 14/14 under unsuppressed TSan. The source-derived quickening inventory passes. Test262 flips were not measured for this commit.