ABI: implement ArrayBuffer copy and allocator ownership

Parent: #134 Related: #140, #163, #164

Implement the shared JavaScriptCore-compatible private ArrayBuffer allocation, copying, and default-allocator ownership boundary used by the pinned Home and Bun consumers. These four exports share backing-store lifetime and failure semantics and should land as one coherent slice.

Acceptance:

• Export Bun__createArrayBufferForCopy with a true fixed-length ArrayBuffer, byte-for-byte copy semantics, empty-buffer behavior, and pending OOM publication.
• Export Bun__allocUint8ArrayForCopy with an uninitialized Uint8Array backing and publish the writable pointer only after successful construction.
• Export Bun__allocArrayBufferForCopy with the pinned Buffer-subclassed Uint8Array result (despite its historical name), uninitialized backing, and success-only pointer publication.
• Export JSArrayBuffer__fromDefaultAllocator as a no-copy ArrayBuffer adoption boundary that releases non-empty mimalloc/default-allocator storage exactly once and does not adopt the zero-length sentinel.
• Preserve VM affinity, invalid-context safety, pointer identity for adopted storage, and empty/oversized failure behavior.
• Add focused engine tests plus compiled Home/Bun consumer coverage in Debug and ReleaseSafe.
• Refresh both generated private-ABI inventories and update the parent issues with exact evidence.

Implemented and pushed to main in 07a3e398.

Evidence:

• all four exact pinned exports compile and link from Home and Bun declarations;
• copy constructors preserve true ArrayBuffer versus Uint8Array/Buffer identity and do not alias source bytes;
• allocation-first exports use uninitialized backing and publish the writable pointer only on success;
• default-allocator ArrayBuffer adoption preserves pointer identity and releases non-empty storage exactly once while ignoring the zero-length sentinel;
• focused Debug and ReleaseSafe engine runs: 3/3, zero leaks;
• Home compiled consumer: 343/343 in Debug and ReleaseSafe;
• dedicated Bun compiled consumer passes in Debug and ReleaseSafe;
• inventories: Home 356/471 private implemented (115 pending), Bun 348/461 (113 pending), zero unclassified;
• CI private-ABI boundary now runs the Bun ArrayBuffer fixture.

The checked-in Home pin remains 7ed99c02; the current local Home checkout is newer (946b6a12), so its source-root revision gate correctly rejects it instead of silently treating it as the pinned profile. The exact pinned inventory and Bun source-root audit pass.