ABI: classify the remaining Bun-owned private profile exports

Parents: #140, #163, #164

Exact inspection of Bun 4982b91e3702094330f3be3883354c52b8c01323 proved that all 24 formerly pending Bun-profile declarations are consumer-provided, not JavaScriptCore imports. Home shares those providers; its only additional pending symbol was the true JSC import completed in #424.

The generated contracts pin provider files, definitions, hashes, and lifecycle/ordering semantics for Bake/async context, one-shot tasks, secrets jobs, termination hooks, debugger startup, loader/plugin/scheduler calls, workers, and the N-API host environment. Independent Home/Bun final-link fixtures provide representative groups from the consumer side and reject duplicate zig-js exports.

Acceptance

• Pin every declaration to its consumer provider file, definition, and source hash for both exact profiles.
• Classify all 24 symbols as consumer_provided while retaining declaration/provider provenance.
• Reject missing/mismatched provider definitions and duplicate zig-js exports.
• Preserve group-specific lifetime and ordering semantics in the contract.
• Add independent Home/Bun final-link fixtures with consumer-side providers.
• Advance Bun to zero pending and Home to one genuine pending JSC import without changing public C-API counts.
• Refresh concise ABI docs/counts and reconcile exact main CI.

Completed by c948437e, df877bb7, and aa695a1a; exact-main run 29806223245 passed 43/43 jobs.

Implemented and pushed in three direct-main commits: c948437e pins/classifies the 24 consumer-owned exports and exact provider contract, df877bb7 adds independent Home/Bun final-link witnesses in Debug/ReleaseSafe/TSan CI, and aa695a1a publishes the terminal counts concisely. Audits now report Home 446/447 private implemented (1 pending) and Bun 437/437 (0 pending), plus 25 separate consumer-provided declarations in each profile. Exact provider hashes/definitions pass against both pinned source trees; Python scanner tests pass 5/5; both final-link witnesses pass Debug, ReleaseSafe, and TSan with 24/24 host symbols and no zig-js collision. Benchmark/conformance scores are unchanged. Final exact gate: https://github.com/zig-utils/zig-js/actions/runs/29803416991

Run 29803416991 completed the new private-ABI boundary successfully, including both provider witnesses in Debug, ReleaseSafe, and TSan. Its only failure was the unrelated but real pre-existing Wasm relocating-grow TSan race now tracked as #425 and fixed in 7ed9d280. Replacement exact gate: https://github.com/zig-utils/zig-js/actions/runs/29805709794

Closed against exact main commit e3fdc52385204c75fe6ae5c64d48dae6e5ede418: Actions run 29806223245 completed successfully with all 43 jobs terminal and no failures.