Strings: canonicalize Annex B CreateHTML attributes

Parent: #473 Related: #666, #676

Problem

The Annex B CreateHTML methods with attributes—String.prototype.anchor, fontcolor, fontsize, and link—coerce the attribute through toStringV and append those physical bytes into a canonical output buffer. With physical flat Latin-1 storage active, non-ASCII attribute text is republished as invalid canonical StringData even though quote escaping and wrapper structure remain otherwise correct.

Scope

• Route the shared CreateHTML attribute coercion through the representation-aware WTF-8 helper.
• Preserve exactly one ToString coercion, method-specific tag/attribute names, double-quote replacement with ", receiver coercion order, exception identity, ASCII borrowing, output ownership, and OOM propagation.
• Cover all four attributed wrappers with non-ASCII text and an embedded quote under canonical and physical flat-Latin-1 storage.

No-workaround rules

• No flat-storage disablement, eager global canonicalization, replacement characters, duplicate coercion, alternate HTML builder, hidden retry, or Test262 exclusion.
• No stack, queue, job, Promise, Worker, or Map/Set iterator changes.

Acceptance

• The shared CreateHTML attribute path consumes canonical semantic WTF-8.
• anchor, fontcolor, fontsize, and link preserve exact non-ASCII text and escape each quote once.
• Each custom ToString hook runs exactly once and after receiver coercion.
• The witness passes with canonical storage and with flat_storage_active enabled, then the switch is restored and not landed.
• Nonzero Annex B Test262 accounting, focused Debug/ReleaseSafe/TSan, and full units pass with exact flips reported.

Landed fix(string): canonicalize CreateHTML attributes (#680) on main.

The shared Annex B CreateHTML attribute path now consumes canonical WTF-8 for anchor, fontcolor, fontsize, and link. The canonical and physical flat Latin-1 witness verifies exact non-ASCII output, one " replacement per embedded quote, one attribute coercion per method, and receiver-before-attribute order.

Evidence: focused Debug, ReleaseSafe, TSan, and physical flat-storage witnesses each 1/1; four affected Annex B Test262 subtrees 28/28 before and after, 0 flips; full units 1773 passed, 1 skipped, 0 failed, 0 leaked across 1774 tests.