Strings: return wrapper StringData without reallocation

Parents: #473, #493 Related: #480

Problem

String.prototype.toString and String.prototype.valueOf implement thisStringValue by extracting asStr() bytes and constructing a new StringCell. The specification requires returning the existing String primitive or a wrapper own [[StringData]] value directly.

The copy is unnecessary allocation on every valid call. More importantly, asStr() is the physical cell representation: for flat Latin-1 it is a one-byte-per-code-unit image rather than canonical WTF-8, so feeding those bytes to the canonical StringCell constructor can trip the invalid-WTF-8 integrity assertion for non-ASCII input.

Upstream Test262 covers ASCII receivers at this boundary and does not exercise the storage representation transition.

Scope

• Return a String primitive receiver directly.
• Return a String wrapper own [[StringData]] Value directly.
• Preserve the exact non-generic brand check and active-native realm TypeError behavior.
• Cover ASCII, flat Latin-1, BMP canonical WTF-8, astral, lone-surrogate, primitive, boxed, borrowed, and cross-realm calls.
• Prove the successful path performs no StringCell allocation or transcoding.

No-workaround rules

• No raw-byte rewrap, replacement characters, representation forcing, hidden copy, Test262 exclusion, or weakened StringCell validation.
• No stacks, queues, jobs, Promise, Worker, or Map/Set iterator changes.

Acceptance

• toString and valueOf return exact StringData content across every supported string representation and receiver form.
• Successful brand-checked calls allocate and transcode zero string backing bytes.
• Invalid receivers still throw the correct realm TypeError.
• Focused String units, relevant nonzero Test262 accounting, allocation/OOM coverage, and the full unit gate pass with zero regressions.

Implementation and evidence

• 4c922933 returns primitive and boxed StringData Values by raw identity from both native and builtin fast paths.
• fa4d29cd expands the zero-allocation witness across ASCII, Latin-1, BMP, astral, and lone-surrogate cells.
• The witness passed 1/1 under canonical storage and 1/1 with flat_storage_active enabled, directly exercising the physical flat-Latin-1 layout; the switch was restored and was not landed.
• Test262 String.prototype/{toString,valueOf}: 14 passed, 0 failed.
• Full unit gate: 1,756 passed, 1 skipped, 0 failed, 0 leaked.

Completed and pushed to main.

• Production: fix(string): return existing StringData values (#666)
• Representation witness: test(string): cover StringData storage classes (#666)
• Successful calls now return the existing primitive or wrapper [[StringData]] Value; no byte extraction, transcode, or StringCell allocation occurs.
• 30 raw-Value identity assertions passed with an allocator that fails its first allocation. The witness also passed with physical flat-Latin-1 storage enabled, then the switch was restored.
• Test262: 14/14 passed across String.prototype.toString and valueOf, including non-generic realm errors.
• Full unit gate: 1,756 passed, 1 skipped, 0 failed, 0 leaked.

No stacks, queues, jobs, Promise, Worker, or Map/Set iterator surface changed.