Strings: canonicalize direct ToString result builders

Parents: #473, #472 Related: #666, #675

Problem

Four owned string result builders still append the physical bytes returned by toStringV into canonical WTF-8 output buffers:

• String.raw substitutions;
• Array.prototype.toLocaleString element results;
• %TypedArray%.prototype.join separators and rendered elements;
• %TypedArray%.prototype.toLocaleString element results.

These paths are byte-identical while flat Latin-1 storage is disabled. With physical flat storage active, a non-ASCII Latin-1 String result can be copied as invalid canonical StringData, corrupting the observable output and any later UTF-16 operation.

Scope

• Route only these direct concatenating ToString consumers through the representation-aware WTF-8 helper.
• Preserve exact coercion count and order, abrupt completion, separator behavior, resize/detach behavior, forwarded locale arguments, output allocation ownership, and OOM propagation.
• Keep ASCII and canonical StringData borrowed without extra conversion.
• Cover primitive and object-returned non-ASCII text under canonical and physical flat-Latin-1 storage.

No-workaround rules

• No flat-storage disablement, eager global canonicalization, replacement characters, duplicate coercion, hidden second pass, Test262 exclusion, or third-party string builder.
• No stack, queue, job, Promise, Worker, or Map/Set iterator changes.

Acceptance

• Every affected result builder appends canonical semantic WTF-8.
• Each custom toString or toLocaleString hook runs exactly once and in specification order.
• String.raw, Array locale output, TypedArray join, and TypedArray locale output preserve exact non-ASCII text.
• The witness passes with canonical storage and with flat_storage_active enabled, then the switch is restored and not landed.
• Relevant nonzero Test262 accounting, focused Debug/ReleaseSafe/TSan, and full units pass with exact flips reported.

Landed fix(string): canonicalize ToString result builders (#676) on main.

The four direct concatenating consumers now cross the representation-aware WTF-8 boundary without repeating coercion: String.raw substitutions, Array locale results, TypedArray join separators/rendered values, and TypedArray locale results. The canonical and physical flat Latin-1 witness verifies exact non-ASCII output plus one raw coercion, one separator coercion, and four locale hooks.

Evidence: focused Debug, ReleaseSafe, TSan, and physical flat-storage witnesses each 1/1; Test262 String/raw 30/30, Array/toLocaleString 12/12, TypedArray/join 32/32, and TypedArray/toLocaleString 39/39 before and after, 0 flips; full units 1769 passed, 1 skipped, 0 failed, 0 leaked across 1770 tests.