Array: retain intrinsic prototypes and use the active AggregateError realm

Parent #465; related #823. Reproduced on pushed e24c4fa, independently of the current Error-intrinsic candidate. Two local forced-tier witnesses fail in the tree walker: replacing globalThis.Array changes the prototype of an array literal; Reflect.construct(AggregateError, [[]], a foreign NewTarget) creates errors with the foreign NewTarget Array prototype instead of the active AggregateError constructor realm. Node 24.18.0 passes both exact witnesses. These are not inferred from an instanceof name heuristic. The existing arrayProto and functionRealmIntrinsicProto Array paths consult public mutable bindings. Acceptance: retain private realm-owned Array identity with tracing/relocation and existing synchronization; use the active constructor realm for CreateArrayFromList while preserving GetPrototypeFromConstructor for the outer AggregateError instance; cover replacement/deletion/shadowing, cross-realm newTarget, callbacks and moving GC in both tiers. Do not copy a public global into a late cache or special-case source strings. Separate from native job/queue lifecycle work.

Uncommitted implementation checkpoint: the root-only intrinsic table now groups Error identities and retained Array constructor/prototype identities without adding per-activation storage. Array allocation/species selection and AggregateError array allocation use those private realm identities. The Array constructor roots its arguments across observable prototype lookup.

A new 32-case reference set passes 32/32 in Node 24.18.0, and the matching engine unit passes all 32 in both forced tree-walker and required-bytecode modes (zero failures/leaks). The 2173-test artifact and ReleaseSafe corpus runner compile. Before/after engine probe counts are pending while the separate #826 full suite runs. This is not ready to close or push: explicit added-slot tracing/relocation, moving-GC callbacks, and sanitizer/full integration still need completion.

The preserved-runner before/after probes are now complete: automatic execution improves 9/32 -> 32/32; forced tree-walker/required-bytecode pairs improve 8/32 -> 32/32; Node reference remains 32/32. These are local witnesses, not claimed test262 flips. The matching 32-case unit also passes both forced tiers. The implementation remains uncommitted pending the explicit GC-slot/moving-callback and sanitizer/full integration checks noted above.

The new GC/ownership validation exposed one failure: 8/9 focused Debug tests passed, but a moving callback during a borrowed foreign Array.prototype.map failed its result-identity assertion. The initial 32 semantic witnesses still pass; they are not sufficient to land this change.\n\nThe audit also found that Array constructors/static methods/prototype methods retain realm environments in native private_data without the corresponding trace/relocation recognition. The working patch now shares the installation method table with that recognition, adds exact managed/non-managed relocation checks, roots the saved Array method environment, and reloads NewTarget after its observable prototype getter. A fresh unsuppressed TSan run is in progress; #824 remains uncommitted.\n\nFresh baseline corpus counts on pushed main (8d68a20): Array 3081/3081, AggregateError 25/25, array literals 52/52. After-run comparison and full integration remain pending. No stacks/queues/jobs lifecycle changes.

The moving-GC failure is now fixed by retaining/reloading the complete map invocation, not just its realm. All 11 focused Array tests pass under unsuppressed ReleaseSafe TSan (zero failures/leaks), and the broader realm filter passes 62/62. The added moving map probes cover length, HasProperty, indexed Get, callback, custom species construction, and result definition in both forced tiers.\n\nThe final candidate also preserves the scoped test262 census: Array 3081/3081, AggregateError 25/25, array literals 52/52 (0 measured flips/regressions). Local witnesses remain automatic 9/32 -> 32/32 and forced pairs 8/32 -> 32/32.\n\nThe exact 2183-test candidate is staged and running the full native four-shard Debug suite. Remaining Array method callback ownership is tracked in #827. #825 is a separate unstaged follow-up and is not included in this validation or planned commit.

Landed fix(array): retain realm intrinsics across callbacks (#824) directly on main as Chris, with the measured impact and validation in the commit body.

Final local integration: 2182 passed, 1 platform skip, 0 failed/leaked across all 2183 linked tests (native four-shard Debug, 847.6s). Unsuppressed TSan passes 11/11 focused Array tests and 62/62 realm tests. All 3158 scoped test262 cases remain passing (0 measured flips/regressions); the 32 issue witnesses pass in automatic and both forced modes.

Current combined-main CI is pending. Keeping this issue open until terminal CI evidence is available. Remaining method operand ownership is explicitly tracked in #827. The uncommitted #825 prototype-type changes were excluded from this commit.

Current CI has a confirmed Linux Debug unit-shard failure, tracked with the exact failing assertion and job evidence in #828. The atomic JSON.stringify failure assertion passed, but the peak-byte budget assertion failed. #824 remains open; the successful local 2182-test Debug run is not a substitute for terminal CI verification.

Terminal descendant-main verification is now complete: CI run 33312141595 on f4f00803 completed successfully with all 56 jobs terminal and no failed/cancelled jobs. This run contains the landed #824 implementation and the subsequent integration history. Closing the issue as completed; any newly reproduced defect should retain its own exact witness rather than reopening this verified scope.