GC relocation: rewrite every runtime root, edge, weak, and finalization reference

Parent: #144\nDepends on: #333, #334\nRoadmap: #134\n\nMake compaction precise across the complete runtime graph rather than only collector-owned cells.\n\n## Scope\n\n- Rewrite all Value and typed-pointer edges in objects, environments, functions, promises, generators, modules, timers, jobs, workers, threads, debugger/inspector state, native-private records, and WebAssembly stores.\n- Rewrite interpreter stacks/frames, escaped frames, temporary roots, concurrent snapshots, C API protection tables, Objective-C managed references, and Bun/Home ABI containers.\n- Preserve WeakMap/WeakSet ephemeron reachability, WeakRef identity, FinalizationRegistry ordering, and exactly-once external-owner finalization.\n- Repair interior/reference projections or pin them explicitly with a checked invariant.\n- Exercise cyclic, cross-realm, cross-thread, and host-reentrant graphs.\n\n## Acceptance\n\n- [ ] Every #333 inventory entry is implemented or explicitly pinned with a test.\n- [ ] Strong/weak/ephemeron/finalization semantics remain exact across repeated moves.\n- [ ] C API, Objective-C, Bun/Home ABI, inspector, Worker/Thread, Promise/module, timer, and Wasm witnesses pass.\n- [ ] No stale old-space address remains reachable after a verified compaction.\n- [ ] Fault-injection, teardown, leak, and focused TSan gates pass.

First complete cell traversal landed via #338 in 8265aa93: Function marking and relocation now share complete closure/realm/home/super/wrapper/import.meta/arrow this/new.target/derived-this-cell/with-stack coverage. The mutable this_cell.value also caused the minor-GC policy to rescan old Function cells. Focused normal and TSan are green with zero leaks; movement remains disabled. #338 awaits a descendant full matrix before closure.

Second cell traversal slice landed via #339 in 4b8983a5: BoundFunction and ModuleNs now rewrite all managed payload slots while preserving arena-owned metadata. Focused normal/TSan are green with zero leaks; movement remains disabled. #339 awaits descendant full-matrix evidence.

Third cell traversal slice landed via #340 in b710cac5: Generator and IteratorHelper coverage is complete, and the audit repaired missing Generator import.meta and persisted-frame marking. Focused normal/TSan and the inventory gate are green; movement remains disabled. #340 awaits descendant full-matrix evidence.

Environment traversal landed via #341 in b76acb13: bindings, disposal state, live aliases, realm prototype, parent, and with-object payloads now rewrite precisely at the world-stopped boundary. Focused normal/TSan are green with zero leaks; movement remains disabled.

Promise traversal landed via #342 in 8bacc09f: all live Promise and reaction payload branches now rewrite at the world-stopped boundary without taking state locks. Focused normal/TSan are green with zero leaks; movement remains disabled.

The first Object slice landed via #343 in c6016fe2: hot prototype/property/accessor/dense-element payloads now rewrite while all Shape/backing metadata stays stable, and weak collection storage is explicitly deferred. Focused normal/TSan are green with zero leaks.

Object rare/exotic strong-state traversal landed via #344 in 80b2d0ca: actual union payloads now rewrite across every non-weak/non-native/non-Wasm managed variant. Focused normal/TSan are green with zero leaks; movement remains disabled.

Ordered weak/finalization Object traversal landed via #346 in 88dae824; focused normal/TSan are green with zero leaks. Remaining Object work is limited to native-private and Wasm callback-owned roots.

Native-private Object roots landed via #347 in 6c8ba4a2; Promise/interpreter/VM/thread tracers now have exact mutating companions and focused normal/TSan are green. Remaining Object boundary: Wasm-owned slots.

Object cell traversal is now complete through #343/#344/#345, ending with Wasm-owned roots in 15822c94. Every cell-kind edge family has a concrete rewriter; production movement remains disabled while Context/interpreter/embedding root registries are implemented next.

Root-rewrite progress: 7012d7a4 and 72068ee1 complete the #349 interpreter/module plus outer Context registry traversal. Focused normal and TSan relocation tests are 6/6 with zero leaks, and the inventory drift gate remains green. Movement is still deliberately disabled; next is the combined per-cell/root binding dispatch and relocation eligibility/pinning policy, followed by the full matrix.

The complete cell/root dispatch is now exercised by real movement in c5727715: all live cells move twice through the #338-#349 rewriters, including representative Object/String/Environment/Function/Promise/Generator graphs and stable protected handles. Full local suite is 1,196/1,196 green and focused TSan is clean. Remaining #335 gates are broader embedding/weak/Wasm compaction witnesses and stale-old-address verification before closure.

Root/edge coverage gained a new inventoried surface in #357 / 3e38a5ac: public Zig ProtectedValue records are traced and relocated under the realm-root lock, preserve their storage address, reject foreign release, and are reclaimed at teardown. The inventory now covers 27 pointer surfaces; Debug/ReleaseSafe/TSan focused tests are green with zero leaks.

Completed and accepted. The implementation-specific local evidence is recorded above, and descendant full CI at https://github.com/zig-utils/zig-js/actions/runs/29716788619 completed with 42 successful jobs, one intentional nightly skip, zero failures, and zero cancellations.