Intl.DateTimeFormat: remove forgeable ordinary construction state

Summary

Intl.DateTimeFormat already resolves constructor options eagerly into an immutable native IntlDateTimeFormatData sidecar, but its constructor still publishes ordinary NUL-prefixed \0intl and \0locale properties. Branding trusts the forgeable service string, and native publication reads the locale back through ordinary object state. Date/Temporal internal helpers repeat this pseudo-object protocol; Temporal also publishes a separate ordinary permission flag.

Make the native sidecar the sole DateTimeFormat brand and configuration source. Pass the resolved locale directly into native publication, carry the Temporal ZonedDateTime permission in the immutable native record, and retain normative ChainDateTimeFormat behavior through the genuine fallback-symbol inner formatter.

Related: #475, #493, #460. Follows the same security/ownership direction as #591 without touching stacks, queues, jobs, Promise, microtasks, or Worker lifecycle.

Frozen boundary

Current main at eb661dce:

• test/intl402/DateTimeFormat: 244/244.
• Existing 10-job construction rows match system JavaScriptCore checksums:
  • default: 91,475,898
  • components: 91,475,898
  • style: 91,475,898
  • locale: 712,810,236

These existing rows are the committed behavioral/performance boundary; no benchmark-only path or replacement fixture is needed.

Requirements

• IntlDateTimeFormatData is the only valid DateTimeFormat brand and owns every steady-state configuration bit.
• Native publication receives the resolved locale explicitly and performs no lookup of \0locale or other ordinary formatter state.
• Public construction publishes no NUL-prefixed ordinary own properties.
• Date and Temporal locale-string helpers publish complete native state eagerly; Temporal ZonedDateTime permission is immutable native state, not an ordinary property.
• resolvedOptions, format, formatToParts, formatRange, and formatRangeToParts reject forged receivers without observing attacker-controlled hidden properties.
• Genuine ChainDateTimeFormat receivers continue to unwrap only through %Intl%.[[FallbackSymbol]]; the bound format accessor targets/caches on the genuine inner formatter, while methods not specified to unwrap still reject the outer receiver.
• Preserve option observation order, locale extension resolution, OOM rollback, moving/concurrent GC safety, and no-GIL race freedom.

Acceptance

• DateTimeFormat remains 244/244 and complete Intl402 has no regressions against the exact parent.
• Regression coverage proves hidden-property forgery rejection, zero deferred reads, public reflection, Date/Temporal internal helpers, and ChainDateTimeFormat behavior.
• Existing OOM, bounded-heap, moving-nursery, shared-realm, and TSan DateTimeFormat gates pass.
• Exact-parent attribution on the four frozen construction rows reports checksums, property/lock/allocation/GC deltas, and does not promote noisy timing into a public claim.
• Full sharded units pass with zero failures/leaks.

Implementation is complete and all acceptance gates are green.

The candidate makes IntlDateTimeFormatData the sole DateTimeFormat brand/configuration record, passes locale directly into failure-atomic native publication, carries the Temporal ZonedDateTime permission as an immutable native bit, removes public/internal \0intl / \0locale / permission-property publication, and preserves ChainDateTimeFormat by binding/caching format on the genuine fallback-symbol inner formatter.

Validation:

• DateTimeFormat test262: 244/244
• complete Intl402: 3341/3341
• ZonedDateTime toLocaleString: 7/7
• focused normal: 8/8, zero leaks
• focused TSan: 8/8, zero leaks/race reports
• full sharded units: 1706 passed, 1 skipped, 0 failed, 0 leaked

Exact-parent 100-job attribution preserves every checksum and collection count. Across default/components/style/locale rows, property locks fall by exactly 89,672 per row (8.8-12.0%), Shape transitions and GC cells fall by exactly 12,816 per row (GC cells -3.8% to -4.7%), and backing allocations fall by 38,446-38,448 (-5.6% to -7.1%). No timing claim is being promoted from this structural change.

Landed on main in fix(intl): require native DateTimeFormat state (#592).

Final gates:

• DateTimeFormat: 244/244
• complete Intl402: 3341/3341
• ZonedDateTime toLocaleString: 7/7
• focused normal + TSan: 8/8 each, zero leaks/races
• full units: 1706 passed, 1 skipped, 0 failed, 0 leaked

DateTimeFormat construction and internal Date/Temporal helpers now publish complete immutable native state without forgeable NUL-named branding, locale, or permission properties. Genuine ChainDateTimeFormat fallback-symbol behavior remains intact.