Strings: bound two-value concatenation

Parents: #473, #493 Related: #480, #777, #781

Problem

Binary string + converted both results to canonical WTF-8, allocated a concatenated scratch buffer, then constructed a StringCell without enforcing the engine string-size ceiling. Flat Latin-1 operands therefore paid whole-input transcodes before the output allocation, and an empty operand still forced a new cell.

The same pattern covered the common zero/one-argument String.prototype.concat paths.

Scope

• Preserve left-to-right ToPrimitive and ToString ordering for binary +.
• Retain the exact non-empty StringData cell when the other operand is empty.
• Compute exact canonical output length, including a trailing-high/leading-low surrogate pair across the boundary.
• Enforce the engine string-size ceiling before allocation.
• Stream flat Latin-1 operands directly into one canonical output buffer.
• Route zero/one-argument String.prototype.concat through the same owned builder.

No-workaround rules

• No rope placeholder, deferred semantic work, arbitrary operand cap, lossy surrogate handling, input-specific cached result, or weaker RangeError/OOM behavior.
• No stacks, queues, jobs, Promise, Worker, or Map/Set iterator changes.

Acceptance

• Empty concatenation operands retain exact StringData identity with zero allocation.
• Two-value results use checked exact sizing and one canonical output buffer.
• Flat Latin-1 and cross-boundary surrogate pairs remain exact.
• Focused normal/TSan/OOM units pass with zero leaks/races.
• Exact-parent Test262 remains 22/22 concat and 48/48 addition, with zero regressions.
• Deterministic threadfuzz passes 400/400 from seed 1.
• The full unit gate passes on a clean, uncontended host.

Implemented and pushed to main in perf(strings): bound two-value concatenation (#782).

Evidence:

• focused unit: 1/1 normal and 1/1 TSan, 0 leaks;
• exact-parent Test262: String.prototype.concat 22/22 → 22/22 and addition expressions 48/48 → 48/48, so 0 flips and 0 regressions;
• deterministic threadfuzz: 400 programs from seed 1, 0 failures.

The issue remains open solely for the full unit gate when the host is uncontended.

Acceptance is complete. Clean main CI run 33071676798 passed all four ordinary unit shards at 872dbbb5; the issue-specific focused normal/TSan/OOM, exact-parent Test262, allocation, and deterministic fuzz evidence is recorded above. Closing with no semantic regressions.