Strings: make exotic descriptors representation-aware

Parents: #473, #493

Problem

String exotic [[GetOwnProperty]] descriptor paths used backing-byte length and one-byte slices for length and indexed character properties. Canonical WTF-8 therefore reported byte counts for non-ASCII strings and could create invalid character backing when a descriptor indexed a multibyte BMP value, astral pair, or lone surrogate. Flat Latin-1 has a different one-byte-per-code-unit storage contract, so the fix is representation-aware rather than routing every access through an unbounded full-string transcode.

The ordinary [[Get]], own-key, has-own, and set paths already used UTF-16 length/index helpers; reflective descriptors and primitive-string CopyDataProperties diverged from them. Existing upstream coverage is ASCII-only at this boundary.

Scope

• Make String exotic length and indexed descriptors use UTF-16 code-unit semantics for primitive and boxed strings.
• Return exact BMP values and canonical lone surrogate units when an astral scalar is indexed.
• Reuse the same representation-aware index helper in ordinary property access and primitive-string CopyDataProperties.
• Keep ASCII and flat Latin-1 indexing O(1); do not transcode an entire flat string to read one unit.
• Cover compatible redefinition of immutable index descriptors without weakening their attributes.

No-workaround rules

• No byte slicing, replacement characters, code-point indexing, upstream exclusions, or full-string transcoding for flat Latin-1 index access.
• No stacks, queues, jobs, Promise, Worker, or Map/Set iterator changes.

Acceptance

• Primitive and boxed string descriptors expose exact UTF-16 length, values, and immutable attributes for ASCII, BMP, astral, and lone-surrogate inputs.
• Compatible index redefinition succeeds and incompatible redefinition remains rejected.
• Object spread/rest over primitive strings copies the same UTF-16 code-unit properties as String exotic reflection.
• Focused String/Object units, relevant nonzero Test262 accounting, and the full unit gate pass with zero regressions.

Implementation is in progress locally. The first focused run reproduced a hard StringCell integrity panic in object spread (truncated WTF-8 sequence for the first byte of U+00E9), confirming that CopyDataProperties shared the descriptor byte-slicing bug. The retained fix uses one representation-aware UTF-16 iterator for spread/rest, O(1) flat-Latin-1 direct indexing, canonical surrogate materialization, ordinary get, reflective descriptors, and compatible immutable redefinition. The exact regression and all three String exotic focused units now pass with 0 leaks; broader gates remain pending.

Implemented and pushed to main as f30b9e0b.

The retained implementation unifies reflective descriptors, compatible immutable redefinition, ordinary property reads, object spread, and object rest on representation-aware UTF-16 code-unit access. Flat Latin-1 direct indexing remains O(1); canonical WTF-8 spread/rest iterates linearly and materializes exact surrogate units. The original focused probe reproduced a hard StringCell integrity panic from invalid U+00E9 byte slicing; the final regression passes without weakening the assertion.

Validation:

• full 8-shard unit gate: 1,755 passed, 1 platform skip, 0 failed, 0 leaked
• focused String exotic group: 3/3 passed, 0 leaked
• relevant Test262: 2,641 -> 2,641 passing across five nonzero subtrees, 0 failures/regressions

No stacks, queues, jobs, Promise, Worker, or Map/Set iterator surfaces were changed.