RegExp protocols: canonicalize flags and replacement StringData

Parent: #473 Depends on audit split: #678 Related: #666, #676

Problem

After the construction/state layer in #678, seven RegExp/String protocol coercions still expose physical bytes from toStringV to canonical scanners or output builders:

• flags in RegExp.prototype[@@matchAll];
• flags in RegExp.prototype[@@match];
• the replacement template and flags in RegExp.prototype[@@replace];
• flags in RegExp.prototype[@@split];
• RegExp flags checks in String.prototype.replaceAll and String.prototype.matchAll.

With physical flat Latin-1 storage active, a replacement template can copy invalid canonical bytes into output, and custom flags StringData can be passed through canonical String construction or protocol scanners in physical form.

Scope

• Route these seven protocol coercions through the representation-aware WTF-8 helper.
• Preserve exact Get/ToString order and count, global/unicode/sticky flag checks, species construction, lastIndex reads/writes, zero-length advancement, replacement-token semantics, functional replacer behavior, split limits/captures, dispatch ordering, exception identity, ASCII borrowing, and OOM propagation.
• Cover custom non-ASCII replacement text and custom flags objects under canonical and physical flat-Latin-1 storage.

No-workaround rules

• No flat-storage disablement, eager global canonicalization, replacement characters, duplicate coercion, alternate regex engine, hidden retry, Test262 exclusion, or changed protocol dispatch.
• No stack, queue, job, Promise, Worker, or Map/Set iterator changes.
• Construction, compile, toString, and legacy state remain owned by #678.

Acceptance

• Every affected protocol byte scanner/output builder consumes canonical semantic WTF-8.
• Custom flags and replacement hooks run exactly once and in specification order.
• Non-ASCII replacement templates preserve exact output under global and non-global replacement.
• The witness passes with canonical storage and with flat_storage_active enabled, then the switch is restored and not landed.
• Relevant nonzero RegExp/String Test262 accounting, focused Debug/ReleaseSafe/TSan, and full units pass with exact flips reported.

The construction/state dependency landed in fix(regexp): canonicalize construction StringData (#678). #679 can now stay limited to the seven match/matchAll/replace/split protocol coercions and their lastIndex/species/replacement ordering witness.

Implementation is complete locally and remains uncommitted pending the isolated Test262 comparison.

Completed final evidence:

• focused Debug 1/1;
• physical flat Latin-1 1/1, including global and non-global replacement, with flat_storage_active restored and absent from the diff;
• focused ReleaseSafe 1/1;
• focused TSan 1/1, zero races/leaks;
• full units 1772 passed, 1 skipped, 0 failed, 0 leaked across 1773 tests.

Exact parent/candidate ReleaseFast runners are frozen for six affected nonzero subtrees totaling 263 files. A bounded process-isolation gate expired before starting any case because separate Home builds/tests remained active; no partial or contaminated Test262 result is being reported.

Landed fix(regexp): canonicalize protocol StringData (#679) on main.

All seven protocol boundaries now consume canonical WTF-8: RegExp match/matchAll/replace/split flags, replacement templates, and String replaceAll/matchAll flag checks. The canonical and physical flat Latin-1 witness verifies exact global and non-global replacement output, one coercion per replacement operation, and the six-step flags-get/ToString/dispatch order.

Evidence: focused Debug, ReleaseSafe, TSan, and physical flat-storage witnesses each 1/1; six affected Test262 subtrees 263/263 before and after, 0 flips; full units 1772 passed, 1 skipped, 0 failed, 0 leaked across 1773 tests.