Function: canonicalize bound and native display-name bytes

Parent: #473 Related: #687, #692, #693

Problem

Function.prototype.bind reads target.name correctly but prefixes its physical Value.asStr bytes when constructing the bound function name. Function.prototype.toString likewise formats a native callable own name through asStr. With physical flat-Latin-1 StringData, non-ASCII names can become invalid or representation-dependent even though the underlying JavaScript String is exact.

Scope

• Read string-valued target names through canonical WTF-8 before SetFunctionName adds the bound prefix.
• Read native callable display names through the same representation-aware boundary before formatting NativeFunction source.
• Preserve BoundFunctionCreate, length publication, observable target name Get ordering, descriptors, Proxy behavior, anonymous bound toString behavior, and exact OOM propagation.
• Keep canonical/ASCII cells borrowed and convert physical flat Latin-1 at most once per consumed name.
• Cover direct data names and accessor-produced target names under canonical and forced-flat storage.

No-workaround rules

• No eager global canonicalization, forced UTF-16 storage, lossy repair, ASCII restriction, duplicate name Get, retry, fallback name on OOM, or special-case source escaping.
• No stacks, queues, jobs, Promise, Worker, or Map/Set iterator changes.

Acceptance

• Bound Function.name and native Function.prototype.toString preserve exact non-ASCII names for every StringData representation.
• Bind ordering remains BoundFunctionCreate, length publication, then one observable target name Get.
• ASCII/canonical names borrow; flat conversion OOM is explicit.
• Focused Debug, forced-flat, ReleaseSafe, TSan, full units, and exact Function bind/toString Test262 accounting pass.

Completed on main in fix(function): canonicalize metadata name bytes (#695).

Function.prototype.bind now reads a string-valued target name as canonical WTF-8 before applying the bound prefix. Native Function.prototype.toString likewise formats semantic name bytes rather than a StringCell physical image. BoundFunctionCreate and length publication still precede one observable target name Get; anonymous bound source, Proxy behavior, descriptors, and OOM propagation are unchanged.

Validation:

• focused Debug: 1/1
• forced physical flat Latin-1: 1/1
• focused ReleaseSafe: 1/1
• focused TSan: 1/1, zero warnings/leaks
• full Debug: 1792 passed, 1 skipped, 0 failed, 0 leaked
• exact parent -> candidate Test262 Function.prototype.bind: 100 -> 100 passed
• exact parent -> candidate Test262 Function.prototype.toString: 80 -> 80 passed
• both transcripts byte-identical; zero failures/flips

The flat-storage switch was restored to false with no tracked diff.