Inspector: call frames, scopes, workers, GC roots, and completion gate

Parent: #139 Depends on #153.

Implement paused-state inspection and close the remaining inspector coherence gaps for the currently registered main-context surface.

Acceptance:

• Publish stable call frames, function/location metadata, and lexical/global scope chains while paused.
• Implement evaluate-on-call-frame and property/object inspection with deterministic remote-object lifetime.
• Keep paused values, environments, VM frames, and inspector handles rooted across GC.
• Define the isolated-worker boundary and deterministic concurrent-session pause ownership. Explicit worker targets are decomposed to #156.
• Cover interpreter, baseline/native tier deoptimization, isolated workers, GC, detach, termination, and teardown end to end.
• Publish final zero-hidden-skip protocol/host evidence for this slice. Close #139 only after #155 and #156 also satisfy the umbrella acceptance list.

Completed:

• cfb9d6f publishes pause-local call-frame IDs, names, exact script locations, this, and live lexical/block/closure/global scope chains on every paused event. Tree-walker and suspendable generator/async VM activations share the representation; GC root tracing includes every live debug caller environment and this value.
• 29d155b adds live evaluate-on-call-frame with lexical reads/writes, strictness, structured exceptions, recursive-pause suppression, and frame expiry on resume.
• af694b5 adds session-owned value/scope object IDs, non-invoking own data/accessor inspection, object groups, explicit release, automatic backtrace release, cross-session rejection, precise-GC protection, and deterministic teardown.
• a8acfaf assigns exactly one deterministic continuation owner while all enabled sessions receive paused/resumed events.
• 80a071a defers callback-driven session release until inspector operations finish and clears live debug hooks before state destruction.
• 54c00c7 proves independently-created workers remain isolated and continue message/termination progress while a main context is paused. It deliberately does not invent parent/child target identity; #156 owns that transport.
• bddbda8 directly asserts that debug-enabled interpreters expose no native owner and registered ordinary functions retain no bytecode entry. The real C host now validates live frames/scopes and mutates a paused binding through Debugger.evaluateOnCallFrame.

Final verification:

• 6/6 focused debugger tests pass with zero leaks.
• 5/5 focused inspector tests pass with zero leaks.
• Nested tree-walker and suspendable VM frames/scopes/frame evaluation pass.
• Real precise-GC remote lifetime/release passes.
• Two-session pause ownership, callback release/detach, and isolated worker progress pass.
• C API audit and real C/C++ hosts pass: 117/117 public symbols plus 12 extensions.
• Machine-readable protocol inventory covers all 20 commands / 8 events with deterministic -32601 for unlisted methods.
• git diff --check is clean.

Scope boundary:

• Pre-attach, eval, module, and generated-function origins remain #155.
• Explicit worker targets and cross-thread inspector transport remain #156.
• Optimizing-tier implementation remains #146.
• Therefore this child is complete, but umbrella #139 stays open.

Completed on main through bddbda8. The final focused debugger/inspector gates and real C/C++ host evidence are green. Historical/dynamic script registration remains #155; worker target transport remains #156, so #139 stays open.