JIT: execute allocating array operations through loop-region runtime ABI

Parent: #449 Roadmap: #133, #146, #134 Related: #433, #445

Deterministic optimizer paths already lowered calls, construction, and literal object/array operations through the precise runtime-operation ABI. Reducible loop lowering rejected those nodes, so array creation and push/growth calls inside otherwise supported loops fell back to bytecode even though their stack-map, OOM, exception, and GC contracts already existed.

Acceptance

• Stage variable-arity call/effect inputs from each exact loop frame state without consuming loop-carried SSA values or exceeding the 128-slot scratch contract.
• Lower calls/construction plus object/array allocation and literal mutation nodes inside general reducible loop regions using block-local step ownership and existing exceptional targets.
• Preserve precise roots across allocating callbacks, exact catch/finally/OOM/termination results, invalidation, moving-GC checkpoints, and canonical Array.push/property semantics.
• Add hot-loop witnesses for packed push growth and array literal allocation, native-on/off results, exact steps, direct optimizer/OSR execution, observable override fallback, and moving GC.
• Pass one focused normal and TSan batch; document the new subset without claiming direct append/reallocation specialization.

Landed

• 96d54ac2 — exact frame-state input staging and loop lowering for calls, construction, allocation, and literal effects; hot push/literal, override/throw, injected OOM, termination, bytecode differential, exact-step, and moving-GC witnesses.
• 59063a77 — README and optimizer documentation, including the explicit VM-kernel/benchmark boundary.
• d372d0ae — direct loop-construction opcode coverage without a second JS function changing tiers.
• zig build test -Dtest-filter='optimizer allocating array': 4/4 passed.
• zig build test -Dtsan=true -Dtest-filter='optimizer allocating array': 4/4 passed, zero leaks.
• zig build release-compatibility-check: 6/12 gates green, private ABI pending=0.

Direct in-capacity append, index==length growth/reallocation specialization, tier arbitration for the published packed-push/sum workload, and exact-parent profile evidence remain #449.

Completed on main through 96d54ac, 59063a7, and d372d0a. Focused normal and TSan allocating-loop gates pass 4/4; direct append/reallocation specialization remains #449.

Follow-up audit from #451 found that reducible loop native-operation metadata only retained names for get_prop/set_prop; block-local init_prop could therefore trap if its callback became observable after a moving-GC checkpoint. a2010acc makes loop name publication match deterministic lowering (init_prop, method calls, private-in) and the focused packed/moving-GC and allocating-array normal/TSan witnesses pass.