Parser: securely seed declaration-name membership

Parents: #493, #496 Related: #554, #760

Problem

Parser early-error and binding classification stores source-controlled decoded identifiers in many default-context std.StringHashMapUnmanaged tables. The process-predictable hash context lets hostile source precompute collision-heavy declaration, parameter, private-name, import/export, import-attribute, and pattern-name sets before evaluation begins.

Scope

• Inventory every parser-owned string membership/index and classify immutable grammar tables separately from source-controlled transient tables.
• Give one parse root a lazy unpredictable exact-byte hash context and use it for every source-controlled parser table; nested template-expression subparsers inherit that same root context.
• Production Context/eval/Function/module parsing derives the parse key from the realm root Shape secure domain source, avoiding an OS entropy request per table or parse-local index.
• Standalone parser entry points acquire secure entropy lazily only when the first source-controlled native table is needed and fail closed if the provider is unavailable.
• Candidate-free parses allocate no membership table and request no entropy.
• Preserve decoded identifier equality, escaped spelling normalization, Unicode/WTF-8 handling, early-error precedence, source locations, scratch reclamation, OOM propagation, and Script/Module distinctions.

No-workaround rules

• No declaration/name/depth cap, source rewriting, blacklist, public/address/time-derived seed, deterministic fallback, hash-only equality, linear fallback presented as hardening, per-table OS entropy call, skipped early error, or weakened syntax rejection.
• No stack implementation, queue, job, Promise, Worker, or Map/Set iterator changes.

Acceptance

• Every source-controlled parser string table uses the parse-root secure context; immutable static grammar lookup remains allocation-free.
• Empty/candidate-free paths stay lazy, nested subparsers inherit the root, and entropy failure publishes no partial context/table.
• Wide, escaped, Unicode, duplicate, shadowed, parameter/pattern, private-name, label, and import/export cases preserve exact diagnostics.
• Focused parser/frontend normal and TSan tests pass with zero leaks/races.
• Exact-parent relevant Test262 syntax/module/language inventories have nonzero accounting and zero regressions.
• Focused source-to-result and parser growth controls show no material ordinary-case regression.

Implemented and pushed to main in fix(parser): seed declaration name membership (#761). All 32 parser source-string map sites now use one lazy securely seeded exact-byte context shared with nested template parsers. Production parsing derives from the realm Shape secret domain; standalone parsing fails closed through secure engine entropy. Verified parser 54/54, frontend 26/26, focused TSan 1/1, public build, and exact-parent test/language 23,647 pass / 1 known failure on both sides (0 flips, 0 regressions). Exact-parent instruction deltas across affected 4,096-item controls were +0.4% to +3.0%.