JIT: specialize in-capacity packed array append

Parent: #449 Roadmap: #133, #146, #134 Predecessors: #448, #450 Related: #433

General optimizer loops can now call canonical push/growth and literal append operations, but every append still crosses the runtime-operation callback. Add a narrow direct AArch64 path only when an isolated packed Array has spare capacity and index==length; reallocation and all observable cases must remain canonical.

Acceptance

• Reuse one auditable dense-Array guard contract for isolated mode, Array brand, ordinary behavior, no proxy/arguments/private state, no holes/cold indexed metadata, no indexed/prototype hooks, extensibility, exact index==length, and spare capacity.
• Directly publish the element and length only after the non-allocating GC barrier; preserve assignment/push result and indexed_own_seen semantics.
• Route reallocation, full capacity, shared realms, restrictions, holes/sparse tails, accessors/attributes, prototype setters, proxies, invalid keys, and every guard miss to canonical callbacks without partial mutation.
• Cover direct in-capacity success, forced reallocation fallback, object-value relocation/barrier, invalidation, exact steps, observable fallback, shared mode, and concurrent mutation with native-on/off witnesses.
• Measure direct-hit/callback counts and the published array workload before changing tier priority; do not bypass a faster VM packed-push kernel without evidence.
• Pass one focused normal/TSan batch, update #449/#133/docs/README, and defer broad gates until the measured #133 checkpoint.

Completed on main in a2010acc and documented in 90de5f08.

Evidence:

• isolated AArch64 exact-end assignment, literal append, and one-argument intrinsic push publish element/length/indexed_own_seen directly after the existing GC barrier;
• a read-only runtime guard validates intrinsic callee identity, extensibility, restrictions, and the complete indexed prototype chain;
• full capacity/reallocation, holes, shared mode, indexed prototypes, overrides, and all guard misses retain the canonical callback;
• direct/callback counters cover assignment, literal append, and push; object values exercise the barrier and moving-GC native-vs-bytecode witness;
• the loop metadata audit also fixed missing block-local init_prop names exposed by the moving-GC test;
• focused normal and TSan batches pass: packed 5/5, allocating array 4/4, with zero leaks; AArch64 release-byte encoding and the existing packed workload/tier-selection witness pass;
• release compatibility remains 6/12 green with private ABI pending=0.

The accepted benchmark headline remains unchanged: the published arrays workload still selects the older VM packed-push/sum kernels before optimizer OSR, so no score was regenerated or claimed.