JIT: specialize reallocating and variadic packed array push

Parent: #449 Roadmap: #133, #146, #134 Predecessor: #451 Related: #433

#451 directly publishes a single spare-capacity append. Complete the allocating side of packed growth without weakening failure atomicity, GC safepoints, observable Array semantics, or the measured VM-kernel tier decision.

Acceptance

• Inventory exact optimizer call_with_this/literal/index-growth shapes for zero-, one-, and multi-value intrinsic push plus capacity exhaustion; keep non-relevant general calls canonical.
• Add one allocation-capable runtime boundary that reserves/grows packed storage atomically, precisely roots receiver and all values, publishes an exact safepoint/deopt state, and reports OOM without partial length/element mutation.
• Specialize zero- and variadic intrinsic push results and exact-end growth only when Array brand, callee identity, restrictions, holes/sparse tails, descriptors, prototype chain, extensibility, and realm mode permit it.
• Preserve canonical callbacks for proxies, accessors/attributes, inherited indexed hooks, shared mutation unless the element lock is owned correctly, invalid keys, oversized lengths, and every guard miss.
• Differential-test spare/full capacity, multiple values, empty push, forced OOM at each allocation boundary, moving GC, invalidation, exact steps, overrides/throws, shared no-GIL mutation, and native-on/off results.
• Measure callback/direct/allocation counts and an exact-parent array profile before changing optimizer-vs-VM tier priority; publish benchmark artifacts only if the accepted comparison matrix actually changes.
• Pass one batched focused normal/TSan gate, then update #449/#133/docs/README and leave broad gates for the final array checkpoint.

Result

f4916c3c adds zero/variadic direct push through eight values and a narrow rooted growth callback for wider or full-capacity pushes. Packed reserve now completes before barriers or publication, so forced OOM leaves length, elements, and the indexed witness unchanged. Direct, narrow, actual-growth, and canonical callback counters distinguish every path.

Focused normal and TSan optimizer batches pass; real shared-array contention passes normally and under TSan; moving-GC/native-off parity, overrides/throws, invalidation, exact steps, object barriers, empty/multiple/wide/full pushes, and forced OOM are covered. c4436ade documents the implementation and the exact-parent db91caba→f4916c3c array profile.

The profile attributes both revisions to the existing VM packed kernels (40 tryFastArrayPush leaves each and no nativeArrayPushGrow leaf), so tier priority and accepted README benchmark scores remain unchanged. Broad combined array gates continue in #453.

Created after #451 completion. Initial boundary: keep shared mode on the existing element-lock callback; for isolated mode, prefer a narrow allocation-capable reserve/append ABI over open-coding allocator internals in generated code. The existing appendPackedDenseElements lock/barrier/failure behavior and optimizer operation stack maps are the reference contract. Broad tests remain deferred until the implementation and exact-parent measurements are batched.

Completed and pushed in f4916c3 and c4436ad. Focused normal/TSan optimizer gates, normal/TSan shared-array contention, packed-kernel tier witness, and release compatibility all pass. Broad combined array gates are tracked in #453.