VM: remove legacy packed-array push loop body kernel

Parent: #498 Related: #1074, #1076, #1077, #491

The live inventory classifies packed-array push as legacy_pattern_kernel / legacy_narrow. The VM recognizes a counted loop containing one intrinsic push, decodes its numeric argument expression, and batches up to 64 calls into a vector push. It also recognizes one add-three-and-bitmask expression. The compiler emits a corresponding structural candidate hint. This conflicts with the no body/benchmark recognizer constraint.

Executed baseline on 3ffad54f: the standard fill-plus-sum witness passes 2/2, asserting push-kernel hits in isolated and synchronized modes while returning 36 with 316 logical steps. The dense-array witness passes 2/2, asserting both push-kernel and add-three/bitmask-specialization hits; fill(8,2,1) returns 806. Own/prototype overrides retain their observed results.

Acceptance:

• Remove the packed-push candidate hint, body recognizer/executor, numeric-expression decoder/specialization, push-only types/constants, plan tag, and hit metrics. Retain general intrinsic-push and indexed opcode paths.
• Ordinary calls preserve result 36 / 316 steps in both modes and the expression witness 806, plus argument evaluation, method/property lookup, receiver effects, overrides, partial effects, and live bindings.
• Actual no-GIL workers, explicit moving-GC roots, source hooks, budget/stop checkpoints, and allocation failures remain covered.
• Focused normal/ReleaseSafe/unsuppressed TSan checks and exact before/after affected test262 and tree/required-VM comparisons show no new failures.
• Regenerate the live inventory/docs/manifest, retain shared helpers needed by other live families, and preserve historical evidence with remaining legacy work explicit.

This removes body-specific work substitution; it does not establish current throughput or complete #498.

Landed in a6a984e7.

Removed the packed-push body recognizer/executor, candidate hint, numeric-expression decoder and add-three/bitmask specialization, push-only types/constants, plan tag, and hit metrics. General intrinsic-push/indexed paths and shared bound helpers remain.

Validation:

• Standard fill-plus-sum witness: 36 and 316 steps in both synchronization modes, 2/2 in normal, ReleaseSafe, and unsuppressed TSan. The expression witness remains 806.
• New execution group 6/6 in each of those modes covers actual four-worker no-GIL execution (aggregate 3,224), method/argument/receiver effects and overrides, partial effects before an exception, live bound changes, explicit relocation of a protected Array followed by warmed append (1,604), eight source-hook events, and exact budget/stop checkpoints.
• The effects oracle returns true in Node and in both tree/required-VM modes on both parent and changed engine binaries.
• Expanded activation allocation-failure check 2/2; retained dense-array fast-path check 2/2.
• Exact parent/after diagnostic and tree/required-VM comparisons: Array 3,081, for 385, while 38, addition 48, subtraction 38, multiplication 40, division 45, remainder 40, bitwise AND 30 — 3,745 total, 0 diagnostic failures before → after, 0 flips. The same five pre-existing tail-call differences remain.
• Inventory self-test and validation pass: 12 guarded families, 4 remaining legacy families, 5 explicit unsupported families. Docs links pass for 378 files and the 51-page build matches the regenerated manifest.

These are scoped local checks; full integration gates run in CI. Historical performance artifacts are unchanged. This removal does not establish current throughput or complete #498.