Perf: classify conservative roots through the GC cell slabs

Parent: #62 Dependency: zig-utils/zig-gc#7 Related: #63

Problem

Mid-script nursery collection conservatively scans the native stack. zig-gc currently rebuilds and sorts an address extent for every live cell once per collection and binary-searches it for every stack word, even though GcCellBacking already maintains sorted chunk address indexes for every owned size class.

In the post-#65 object_churn sample, the generic sort is 98 top-of-stack samples and conservative lookup is 73, making root classification one of the largest remaining collection costs.

Scope

• classify arbitrary addresses against the existing per-size-class chunk indexes;
• map issued owned slots back to their exact allocation base while distinguishing outside/unissued storage;
• compile-time prove every current CellKind allocation fits owned slab storage before claiming the generic fallback is unnecessary;
• preserve exact payload-extent/header-magic validation in zig-gc;
• retain thread-safe classification in parallel/concurrent modes;
• compare the exact bounded object_churn checksum and profile before/after.

Acceptance criteria

• Current cell taxonomy is exhaustively covered by a compile-time owned-size proof.
• Live exact/interior stack roots survive minor/full collection.
• Header, padding, freed, unissued, and foreign addresses reject safely.
• The generic per-collection sort disappears from the downstream profile.
• Exact checksum remains 1030552128 and throughput materially improves.
• Focused dependency/downstream tests and final batched suites pass.

Implemented and pushed directly to main in ecd5bb4, on top of zig-gc 51c491e.

The zig-js binding now classifies conservative machine words through the existing GC cell slab chunk indexes, distinguishes owned-but-unissued storage, and returns exact issued slot bases for zig-gc header and payload validation. A compile-time exhaustive CellKind check guarantees that every managed cell kind uses owned slab storage before the generic address-index fallback is skipped.

Validation:

• zig-js: 752/752 tests passed, 0 skipped, failed, or leaked
• comparison harness: 7/7 tests passed
• zig-gc: 26/26 tests passed
• exact object_churn checksum: 1030552128 in both engines

Clean pinned A/B, alternating runs:

• baseline zig-js 0d118f2 plus zig-gc a0b9101: 772.279 ms median
• current source plus zig-gc 51c491e: 669.867 ms median
• elapsed reduction: 13.3 percent, 1.153x speedup

Profiler impact:

• generic per-collection sort.block leaf: 98 samples to 0
• Visitor.markConservativeWord: 73 samples to 23

Fresh post-gate 100-job, 7-sample medians:

• zig-js: 726.826 ms
• JSC: 120.927 ms
• remaining gap: 6.01x

Acceptance criteria are met.