TSan: atomically publish lazy Object cold sidecars

#123 release/acquire-publishes the active ObjectColdState.rare kind, but the nullable Object.cold pointer that owns the sidecar is still installed with a plain store in ensureCold and read without backing_lock by hot generic probes (proxyHandler, boxedPrimitive, sparse-array checks, tracing helpers, and others).

Many exotic objects receive their sidecar before publication, but ordinary live objects can allocate it later—for example when dense deletion first creates sparse-array hole state. A peer property lookup can therefore race the null-to-pointer store before it even reaches #123's synchronized rare tag.

The pointer is one machine word. Publish it as std.atomic.Value(?*ObjectColdState) with release/acquire helpers; retain backing_lock for allocation uniqueness and payload mutation.

Acceptance

• Publish the lazy null-to-sidecar pointer with release ordering and acquire it on every unlocked read.
• Update tracing/finalization and direct test construction without changing ownership or teardown order.
• Keep Object in the 256-byte GC slab.
• Pass focused semantic, GC/finalization, normal unit, and TSan gates.

Implemented and pushed to main in d35841a. The lazy Object.cold pointer now uses release/acquire publication, and every unlocked consumer—including tracing and finalization—goes through the acquire helper. Local batched validation passed: 773/773 normal tests with zero leaks, the mapped-arguments focused test under normal and TSan builds (2/2 each), and the exact Date CVE TSan regression (1/1). Object/ObjectColdState remain within the 256-byte slabs. Leaving this open until the fresh full-main CI run validates the combined #123/#124 head.

The combined d35841a run cleared the focused unit/threadfuzz publication races. A distinct raw-f64 atomic lowering issue remained in the Date corpus case and is now fixed separately by #126 / 4bad7a7. Moving this issue's close gate to the replacement full-main run so the exact final head is validated once.

Completed in d35841ae. Focused semantic/GC/finalization checks and all four TSan unit shards plus tsan-parallel-js were green in run 29465812082; the sole unrelated failure was #126 in the Date corpus case.