Implement DOMFormData private ABI and Blob entries

Parent: #134

Child of #140, #163, and #164. Implement the complete shared DOMFormData family against the engine FormData object rather than a disconnected native placeholder.

Scope

• DOMFormData__forEach
• DOMFormData__toQueryString
• WebCore__DOMFormData__append
• WebCore__DOMFormData__appendBlob
• WebCore__DOMFormData__cast_
• WebCore__DOMFormData__count
• WebCore__DOMFormData__create
• WebCore__DOMFormData__createFromURLQuery
• WebCore__DOMFormData__fromJS
• WebCore__DOMFormData__toQueryString

Acceptance

• Use the existing JS FormData object and hidden entry list as the canonical native handle, including JS-constructed instances.
• Upgrade FormData entries from string-only pairs to exact string or Blob/File values while preserving insertion order and WebIDL string conversion.
• Replace unpaired surrogates with U+FFFD for native string names, values, and filenames as WebCore does.
• Parse and serialize application/x-www-form-urlencoded data exactly; serialization omits Blob entries.
• Preserve duplicate keys, empty names/values, plus-space rules, percent escapes, and UTF-8 behavior.
• appendBlob must retain an opaque native Blob payload and filename for exact native forEach round-trip without pretending the opaque pointer exposes bytes. JS-originated File values retain identity when no replacement filename is supplied; plain Blob values and explicit filenames create a File over the same bytes, per the current HTML create-an-entry algorithm.
• Validate canonical handles and VM ownership for cast_/fromJS; reject foreign, stale, exception, and non-FormData cells.
• Callback bridges must expose borrowed ZigString views for string entries and exact blob pointer/filename/is_blob fields for blob entries.
• Add focused engine tests and compiled Home/Bun consumer evidence in Debug and ReleaseSafe.
• Refresh both pinned inventories and concise coverage docs. Root benchmark numbers change only after a new accepted benchmark run.

Implemented and pushed to main in 172fea6.

Evidence:

• All ten pinned DOMFormData exports share the engine branded FormData entry list.
• Exact form-urlencoded parsing/serialization, USVString replacement, duplicate order, Blob omission, VM-scoped casts, and opaque native BlobImpl pointer round-trip are covered.
• Current HTML entry semantics are explicit: File identity survives only without a replacement filename; plain Blob and explicit filename paths create File entries.
• Forced full-GC survival is covered before native callback projection.
• Debug: Home 362/362 and Bun DOMFormData 10/10 runtime fixtures passed.
• ReleaseSafe: the same fixtures passed, plus 25/25 relocation tests.
• Inventories now report Home 375/471 implemented and Bun 367/461 implemented, both with zero unclassified entries.
• Detailed ABI/API docs and the CI boundary were refreshed. The root benchmark table was intentionally unchanged because no accepted benchmark run was performed.