ABI: implement private class and AggregateError classification

Parents: #163, #164

Implement the shared private callable/error classification boundary.

Acceptance:

• Export exact JSC__JSValue__isClass and JSC__JSValue__isAggregateError signatures.
• Match JSC call-data classification: JavaScript class constructors follow their executable class flag, ordinary/arrow functions are false, bound functions are false, and native constructors are true.
• Preserve constructable proxy behavior and reject primitives/non-callables.
• Classify only real AggregateError ErrorInstances, including subclasses, independent of mutable name/prototype properties.
• Reject ordinary errors, spoofed objects, exception cells, invalid handles, and foreign-VM values safely.
• Cover exact signatures, JS/native/bound/proxy callables, AggregateError/subclass/mutation/spoofing, sibling/foreign ownership, and invalid inputs in the compile-link-runtime fixture.
• Update both inventories and README/API documentation without changing public/extension counts.

Implemented and documented on main.

Evidence:

• implementation: f31c21a6
• published README/API evidence: 7cae3e39
• focused private runtime fixture: 53/53 symbols linked and passed
• Home inventory: 55/432 implemented, 377 pending
• Bun core inventory: 55/422 implemented, 367 pending
• public C and Bun audits pass; public/extension accounting remains 117/19

The slice also fixes context-group realm initialization so sibling realms share well-known Symbol identity and the Symbol registry. The fixture covers JS classes, ordinary/arrow/native/bound/proxy callables, AggregateError subclasses and mutable-property spoofing, cross-realm has-instance/iterator behavior, and foreign/invalid inputs.