VM: quicken Array creation through inherited writable indexed data

Parent: #498 Related: #1052, #1053, #1069, #1072

An executed module-root witness assigns four numeric/canonical String indices on an Array with ordinary writable indexed data inherited through two intermediate objects. Results are already correct (own values sum 38, prototype values remain sum 10, logical length 1,000,002), but fast-path attribution is dense 0/2 and sparse 0/2 because the current creation gate rejects any indexed prototype property.

Scope: prove exact-key prototype permission for ordinary Array own-element creation. A nearer writable data descriptor permits creation even if a farther prototype has an accessor or readonly descriptor. Accessors, readonly data, and exotic holders must retain canonical Set behavior. Bulk append/vector gates keep their separate whole-range proof.

Acceptance:

• Snapshot indexed descriptor writability coherently under the existing indexed/property/element lock order, without adding shared mutable state.
• Numeric and canonical String dense/sparse own creation through ordinary writable ancestors uses the guarded path, leaving prototype data unchanged.
• Nearest-descriptor ordering, dense/sparse holders, read-only/accessor/exotic boundaries, receiver length/extensibility, RHS/key effects, mutation, and restriction ownership are pinned.
• Normal, ReleaseSafe, and unsuppressed TSan focused tests pass, including actual no-GIL workers; exact before/after relevant corpus and VM witnesses introduce no new failing paths.
• Update and regenerate the quickening inventory and docs.

The observed counters are dispatch attribution, not timing/throughput evidence. The broad #498 performance gate remains separate.

Landed in 87bbc09. Array own-index creation now proves exact-key permission through ordinary ancestors. A nearer writable data descriptor permits own creation without visiting farther setters/readonly data; readonly/accessor/exotic cases remain canonical. Bulk append/vector gates retain their separate whole-range proof.

The new Object snapshot reads writability and presence in indexed/property/element lock order. It adds no shared mutable state or persistent metadata. Numeric clean-chain stores still avoid decimal-key formatting.

Validation completed:

• the original witness retains own sum 38, prototype sum 10, and length 1,000,002; fast-path attribution moves from dense 0/2 + sparse 0/2 to 2/2 + 2/2;
• the inherited-creation focused filter passes 4/4 normally, under unsuppressed TSan, and ReleaseSafe, including four actual no-GIL workers;
• existing dense/sparse creation and strengthened deep restriction tests pass 5/5;
• Node-confirmed nearest-descriptor/receiver matrix passes in tree and required-VM modes, including dense readonly holders, setters above shadowing data, frozen length, non-extensibility, readonly conversion, key/RHS effects, and GC reentry;
• Array 3,081, Reflect.set 18, and assignment 485 corpus outputs are byte-identical before/after, all passing;
• inventory writer, fail-closed self-test, and validator pass; 378-file docs links and the manifest-checked 51-page docs build pass.

The final paired VM sweep is also byte-identical: all 3,584 cases agree in tree and required-bytecode modes, with zero divergences. Flips 0 test262 cases and zero measured regressions in that scope. Full hosted CI on this commit remains pending. No timing, throughput, or global conformance-score claim is made.