TSan: publish rare object sidecar state atomically

Full-main CI run 29460517377 exposed four TSan job failures that all reduce to the same ObjectColdState.rare publication race:

• tsan-nogil-corpus (shard 1/4): setDateMs raced a generic boxedPrimitive union probe in cve/mc-tear-date-cache.js.
• tsan-threadfuzz: proxyHandler raced one-time rare-state initialization.
• tsan-unit (shard 1/4) and tsan-parallel-js: the mapped-arguments no-GIL test read proxyHandler while a peer initialized sparse_array.

ensureRare serialized the tagged-union none -> kind transition with backing_lock, but hot generic probes read the union tag/payload without that lock. A probe for the wrong exotic kind can therefore race the one-time initialization, and switching over the tagged union may copy an unrelated active payload (for example the atomic Date milliseconds word).

The general fix is a separate atomic rare tag: initialize the union under backing_lock, release-publish the tag, and require every unlocked rare-state probe to acquire/check it before touching the now-stable union payload. This avoids adding a backing lock to every property lookup.

Acceptance

• Publish every none -> rare kind transition with release/acquire ordering.
• Convert all unlocked rare-state probes and clear paths to check the atomic tag before union access.
• Preserve the per-kind synchronization for mutable payload fields such as Date milliseconds.
• Pass normal and TSan mapped-arguments reproducers with zero leaks/races.
• Pass the Date CVE corpus case and a fresh full-main TSan run.

Implemented and pushed as c982953. Local validation: normal mapped-arguments reproducer 2/2 clean; TSan mapped-arguments reproducer 2/2 clean with zero warnings/leaks; exact TSan cve/mc-tear-date-cache.js corpus case 1/1 passed; Object/ObjectColdState remain in the 256-byte slabs. Leaving open for the fresh full-main TSan gate.

The adjacent nullable Object.cold pointer publication is now fixed in #124 / d35841a, so the full-main gate for this issue has moved to combined CI run 29462319298 at d35841a. The focused former-failure TSan cases pass locally; I will close this only after the relevant full CI shards pass.

Run 29462319298 confirms the original rare-sidecar races are fixed: tsan-unit shard 1 and tsan-threadfuzz passed. Its remaining shard-1 Date race was a distinct compiler-lowering problem now tracked/fixed by #126 in 4bad7a7. The next full-main run is the combined close gate.

Completed in c982953e with the cold-pointer and Date follow-ups #124/#126. Replacement run 29466730465 has green TSan unit shards, tsan-parallel-js, tsan-threadfuzz, and the suppression-free Date corpus shard on Zig dev.1413; the rare-union publication races are closed.