RegExp: canonicalize construction and state StringData

Parent: #473 Related: #666, #676, #677

Problem

The owned RegExp construction/state layer still consumes or stores physical bytes from toStringV at seven StringData boundaries:

• explicit and regexp-like flags in the RegExp constructor;
• pattern and flags in RegExp.prototype.compile;
• generic source and flags in RegExp.prototype.toString;
• the legacy RegExp.input / RegExp.$_ setter.

With physical flat Latin-1 storage active, a non-ASCII pattern can fail compilation, generic toString can emit invalid canonical StringData, and legacy input can be republished from physical bytes. Flags are ASCII by grammar, but their coerced StringData still enters the owned flag scanner and state constructor and must use the same semantic boundary.

Scope

• Route these seven construction/state coercions through the representation-aware WTF-8 helper.
• Preserve exact Get and ToString order/count, constructor identity fast paths, flag validation, compile rollback, lastIndex reset, generic toString ordering, legacy brand checks, exception identity, ASCII borrowing, and OOM propagation.
• Cover non-ASCII compile/toString/legacy input plus exact constructor coercion counts under canonical and physical flat-Latin-1 storage.

No-workaround rules

• No flat-storage disablement, eager global canonicalization, replacement characters, duplicate coercion, alternate regex engine, hidden retry, or Test262 exclusion.
• No stack, queue, job, Promise, Worker, or Map/Set iterator changes.
• RegExp symbol protocols and String replace/match/split dispatch are follow-up scope, not bundled here.

Acceptance

• Every owned RegExp construction/state StringData reader consumes canonical semantic WTF-8.
• Non-ASCII compile patterns, generic toString source, and legacy input preserve exact text.
• Constructor/compile hooks run once and in specification order; failed compile rolls state back.
• The witness passes with canonical storage and with flat_storage_active enabled, then the switch is restored and not landed.
• Relevant nonzero Test262 accounting, focused Debug/ReleaseSafe/TSan, and full units pass with exact flips reported.

Implementation is complete locally and remains uncommitted pending the required isolated Test262 comparison.

Completed evidence:

• focused Debug 1/1;
• physical flat Latin-1 1/1, with flat_storage_active restored and absent from the diff;
• focused ReleaseSafe 1/1;
• focused TSan 1/1, zero races/leaks;
• full units 1771 passed, 1 skipped, 0 failed, 0 leaked across 1772 tests.

Frozen exact runners are ready for the 1879-file RegExp tree, 23-file Annex B compile subtree, and 4-file legacy-input subtree. Two bounded quiet-window gates expired before starting any case because a separate Home corpus remained active; no partial or contaminated Test262 result is being reported.

Follow-up protocol scope is tracked in #679. This keeps #678 limited to constructor, compile, generic toString, and legacy input while the seven match/matchAll/replace/split coercions get independent ordering evidence.

Landed fix(regexp): canonicalize construction StringData (#678) on main.

All seven construction/state boundaries now consume canonical WTF-8: constructor flags, compile pattern/flags, generic toString source/flags, and legacy RegExp input. The canonical and physical flat Latin-1 witness verifies exact non-ASCII compile, matching, description, and legacy input plus one constructor coercion and the six-step compile/description order.

Evidence: focused Debug, ReleaseSafe, TSan, and physical flat-storage witnesses each 1/1; targeted Test262 constructor, toString, Annex B compile, and legacy input matrix 45/45 before and after, 0 flips; full units 1771 passed, 1 skipped, 0 failed, 0 leaked across 1772 tests.