GC relocation: prove native callback safepoint rejection

Parent: #336 Related: #334, #335, #351 Roadmap: #144, #134

Prove the current native boundary is fail-closed before broadening movement to concurrent/JIT states.

Scope

• Invoke the public compaction extension reentrantly from a C host callback while a JavaScript interpreter is active.
• Require explicit rejection before any collection or movement can begin.
• Protect a tail object through the counted C handle table, compact at the next quiescent host boundary, and prove the stable wrapper's underlying cell is rewritten.
• Verify the protected value remains usable and preserves identity/property semantics after movement.

Acceptance

• Native callback reentry reports unsupported without opening relocation.
• Quiescent movement succeeds on the same fragmented realm.
• The stable protected C handle survives while its payload address changes.
• Focused Debug, ReleaseSafe, and TSan tests pass without leaks.

Implemented and pushed as 15e6b552. The C host callback calls ZJSContextCompactGarbage reentrantly while its interpreter is active and deterministically receives rejection without opening relocation. The same fragmented realm then compacts at the next quiescent host boundary; a counted JSValueProtect wrapper keeps stable identity while its underlying Object payload address changes, and property access still returns the expected value. Focused Debug, ReleaseSafe, and TSan runs each passed 3/3 with zero leaks; git diff --check passed.