Strings: compose custom toStringTag from physical storage once

Parents: #473, #493 Related: #480

Problem

Object.prototype.toString accepts a String-valued Symbol.toStringTag and builds "[object " + tag + "]". The current implementation reads the tag through physical asStr() bytes and concatenates them as though they were canonical WTF-8.

With physical flat-Latin-1 storage enabled, a non-ASCII tag contributes raw one-byte code units to a canonical StringCell constructor. That can misencode the result or trip the invalid-WTF-8 integrity assertion. Calling asWtf8 first would restore correctness but add a temporary conversion allocation before the already-required final output allocation.

Scope

• Compose prefix, String Value content, and suffix directly into one exact owned canonical WTF-8 buffer.
• Borrow/copy canonical storage directly and encode physical flat Latin-1 into its final destination.
• Preserve getter/proxy ordering, String-only tag acceptance, UTF-16/lone-surrogate content, realm behavior, maximum-string checks, and OOM propagation.
• Provide a reusable internal affix composer for adjacent output boundaries without exposing physical storage.
• Cover ordinary, primitive-wrapper, Proxy, cross-realm, ASCII, Latin-1, BMP, astral, and lone-surrogate tags.

No-workaround rules

• No representation forcing, replacement characters, hidden temporary transcode, validation weakening, Test262 exclusion, or double-allocation flat path.
• No stacks, queues, jobs, Promise, Worker, or Map/Set iterator changes.

Acceptance

• Exact Object.prototype.toString output for every supported String representation and observable receiver form.
• One exact backing-buffer allocation for the composed bytes; no flat conversion scratch.
• OOM and maximum-length failures propagate without invalid partial StringCells.
• Focused canonical/flat units, relevant nonzero Test262 accounting, and the full unit gate pass with zero regressions.

Landed on main in 170aa4a8.

The runtime now composes String-valued Symbol.toStringTag output directly into one exact final backing image, with representation-aware canonical/flat-Latin-1 encoding, streaming canonical content hashing for flat storage, checked length/OOM propagation, and a managed-GC publication path with exact byte accounting. No conversion scratch, representation forcing, validation weakening, or job/queue/Promise/Worker/Map/Set surface changed.

Validation:

• canonical storage: interpreter + required-bytecode custom-tag tests pass; exact allocation/failure tests pass; managed-GC publication passes;
• flat storage: the same focused representation and managed-GC tests pass, including Latin-1 hash identity and zero leaks;
• receiver/content matrix covers ordinary objects, boxed String, Proxy getter exactly once, cross-realm receiver, ASCII, Latin-1, BMP, astral, and lone-surrogate tags;
• Test262 test/built-ins/Object/prototype/toString: 41 → 41, zero failures/flips;
• full sharded units: 1,764 passed, 1 skipped, 0 failed, 0 leaked;
• focused managed-GC TSan: 1 passed, 0 failed, 0 leaked.

All acceptance rows are complete.