Temporal: publish native state through the engine private word

Parent: #475 Follows: #595

Profile

After #594/#595, the frozen Temporal row is allocation-visible: makeTemporal, Object.ensureCold, GC-cell slab allocation/publication, malloc/free, and young collection are prominent sampled leaves. Every Temporal result currently performs three backing allocations: ObjectStorageState, the typed TemporalData record, and an ObjectColdState whose rare union carries only that record pointer. The 100-job row creates 47,788 GC cells and performs 80,824 backing allocations.

Scope

• Reuse the existing engine-owned Object.private_data word for the TemporalData pointer when the fresh wrapper has no competing internal/host payload, mirroring the Promise publication model.
• Preserve the cold rare-state fallback and move the Temporal pointer there before C-API host private data or class metadata takes ownership of the hot word.
• Keep TemporalData allocation/finalization, backing accounting, GC reachability, relocation, OOM rollback, and exact brand semantics unchanged.
• Make the common published Temporal edge immutable and avoid a separate cold-sidecar allocation.

Acceptance

• C-API tests prove attaching host private data preserves Temporal state identity and behavior through the cold spill.
• GC/OOM/lifecycle and focused normal/TSan gates pass with zero leaks/races.
• Core and Intl402 Temporal subtrees remain exact.
• Exact-parent attribution reduces backing allocations by the expected per-object amount with matching checksum/GC-cell counts.
• Base and reversed frozen timings do not regress; full sharded units pass.

No-workaround rules

No untracked pointer, missing spill path, untraced GC edge, skipped finalizer/accounting, C-API refusal, broadened host-data aliasing, or process-global cache.

Landed in c544df8e.

Temporal wrappers now publish their immutable native record through the existing hot Object private word. C API host attachment spills that record to rare state before taking ownership of the word, preserving exact native identity. The spill is failure-atomic under allocation failure.

Measured against exact parent 6be183d:

• 100 representative jobs: backing allocations 80,824 -> 61,024 (-19,800); allocated bytes 28,746,277 -> 24,944,677 (-3,801,600); peak backing bytes 25,785,394 -> 23,176,690 (-2,608,704).
• 21 paired 1,000-job samples: base median 93.200 ms -> 89.796 ms (-3.65%); variant 92.495 ms -> 89.108 ms (-3.66%). Checksums and attribution counters remained exact.
• test262 Temporal: 4,603/4,603 before and after; Intl402 Temporal: 2,029/2,029 before and after.
• Full units: 1,710 passed, 1 platform skip, 0 failed, 0 leaked.
• Focused normal and TSan C API ownership, allocation-failure rollback, and GC finalization checks pass.

This keeps ordinary Temporal construction allocation-lean without weakening C API ownership or collector invariants.

Completed by c544df8e; the evidence and validation are recorded above.