GC: enforce the Object slab class without host-layout pinning

CI root: https://github.com/zig-utils/zig-js/actions/runs/29693769324/job/88210905218 Related: #131, #97 Roadmap: #44, #49, #134

Root cause and implementation

The stale witness first appeared to be a host-layout assertion, but focused measurement found a real regression: ObjectColdState was 240 payload bytes / 272 raw GC bytes. Instance-only WebAssembly tracing metadata had widened the entire rare-state union.

Commit 4a391cd8 groups the 48-byte Instance tracing record behind one arena-owned pointer. Ordinary Object remains 96 payload / 128 raw bytes; ObjectColdState returns to 224 payload / 256 raw bytes. The trace snapshot still copies the same global roots, callback, context, imports, and object edges under the same backing lock.

The raw Object payload assertion is now target-independent while the exact 128-byte allocation-class gate remains authoritative.

Acceptance

• Restore ObjectColdState to the 256-byte GC allocation class.
• Keep Object in the exact 128-byte GC allocation class across target ABI layout differences.
• Preserve complete WebAssembly Instance GC tracing and stable arena ownership.
• Pass the focused layout witness (3/3, zero leaks).
• Pass Linux normal/TSan replacement CI.

README benchmark scores are unchanged: this restores an intended allocation class and does not constitute a newly accepted comparison matrix.

Replacement run 29697559754 has all four Linux normal unit shards green on 7650986f. The matching TSan unit shards are still running; this issue remains open until that half of the gate completes.

Replacement run 29697559754 has all normal unit shards green and the relevant TSan unit shards 1/2 green on 7650986f; the exact 128/256-byte allocation-class gates pass on Linux.