VM: remove legacy polymorphic property loop body kernel

Parent: #498 Related: #1074, #1076, #1077, #1078, #491

The live inventory labels the polymorphic property loop as legacy_pattern_kernel / legacy_narrow. It recognizes one exact 38-bytecode indexed-selector/update/checksum body, then batches selected-object property reads/writes, numeric arithmetic, and loop control. A compiler candidate hint admits the body. This conflicts with the no body/benchmark recognizer constraint.

Executed baseline on a6a984e7: the kernel-hit witness passes 2/2. In both synchronization modes, ordinary objects return 2,498 with 1,287 steps, and the accessor variant returns 1,602,498 with 1,485 steps. Both results match Node. The witness asserts hits in isolated execution and no kernel hits in synchronized execution.

Acceptance:

• Remove the polymorphic-loop candidate hint, exact body recognizer/executor, plan type/tag, and hit metric; retain general polymorphic property inline caches, ordinary indexed operations, and shared helpers still needed by live families.
• Preserve both baseline results/step counts in both modes and ordered property/receiver effects, shape/descriptor/prototype changes, coercion, and partial effects before exceptions.
• Cover actual no-GIL workers, explicit moving-GC roots, source hooks, budget/stop checkpoints, and allocation failures.
• Focused normal/ReleaseSafe/unsuppressed TSan checks and exact before/after affected test262 and tree/required-VM comparisons show no new failures.
• Regenerate live inventory/docs/manifest; preserve historical artifacts and explicit labels for remaining legacy work.

This deletes body-specific work substitution; it is not current throughput evidence or completion of #498.

The failed live-property witness exposed a pre-existing descriptor-lifecycle bug, now fixed separately in bc37401b (#1080).

After an accessor deleted itself and changed the prototype, recreating the key retained its old non-writable attributes. The next assignment was blocked: Node returned [59,59,50], while both parent tiers returned [54,54,50]. Both engine tiers now match Node. Normal/ReleaseSafe/unsuppressed TSan regressions and 3,965 exact-parent property/assignment/delete corpus comparisons pass with 0 flips or new differences.

The kernel removal was saved separately during that fix and will resume with the original live-property expectations intact.

Landed in 7decd4fc, after the separate #1080 descriptor fix.

Removed the exact 38-bytecode polymorphic property loop recognizer/executor, candidate hint, plan type/tag, and hit metric. General polymorphic inline caches, ordinary indexed operations, and shared helpers remain.

Validation:

• Both synchronization modes retain 2,498 / 1,287 steps for ordinary objects and 1,602,498 / 1,485 steps for the accessor variant, matching the measured baseline and Node results.
• Execution group 7/7 in normal, ReleaseSafe, and unsuppressed TSan covers four actual no-GIL workers (9,992 aggregate), ordered Proxy/receiver effects, live descriptor/prototype changes, coercion and partial exceptions, 32 source-hook updates, and exact budget/stop checkpoints.
• Moving GC requires both the protected selector Array and a selected object to change address. The warmed update then returns 7,538, with the expected updated properties.
• Expanded activation allocation-failure check 2/2; retained four-shape inline-cache and active-writer snapshot checks 2/2.
• The effects probe returns true in Node and both execution modes on the committed #1080 parent and changed binaries.
• Exact parent/after Object 3,411, Array 3,081, assignment 485, for 385, while 38, addition 48, remainder 40, and bitwise AND 30 comparisons: 7,518 total, 0 diagnostic failures before → after, 0 flips, and the same five pre-existing tail-call differences. Distinct binary hashes are verified.
• Inventory self-test/validation pass with 11 guarded families, 3 remaining legacy families, and 5 explicit unsupported families. Docs links pass for 378 files, and the 51-page build matches the refreshed manifest.

These are scoped local checks; full integration gates run in CI. Historical performance artifacts remain intact. This removal does not establish current throughput or complete #498.