Observability: make runtime attribution snapshots transactionally coherent

Parent: #461 Discovered by: #844 Related: #531

Problem

RuntimeAttributionProfiler records one logical allocation or slab-lock event by updating several independent atomic counters. snapshot() reads those atomics independently. Under shared-realm allocation or concurrent GC, a reader can observe an intermediate state and emit mathematically impossible attribution even though the completed event accounting is exact.

A representative quick collection exposed this at the 2-lane representative_weak_collections row: the publication gate correctly rejected the incoherent allocation equation. Three immediate reruns of the exact native row were coherent, which identifies snapshot timing rather than a persistent accounting defect.

Scope

• Give runtime-profiler counter snapshots a linearizable/stable mutation boundary that supports multiple concurrent writers.
• Preserve exact backing-byte, GC-cell-kind, and slab-lock decomposition invariants without serializing the engine allocator on a global mutex.
• Keep instrumentation opt-in; the production-disabled path must remain unchanged.
• Add deterministic concurrency tests that force a snapshot to overlap a partially recorded logical event.
• Keep pause-sample locking and all publication validation strict.

Acceptance

• A snapshot cannot expose a partial backing allocation/growth/release, GC-cell allocation/free, or slab-lock event.
• Concurrent writers cannot make a sequence boundary appear stable while any writer remains active.
• Focused unit and TSan tests pass, and representative attribution quick collection completes without weakening allocation/lock invariants.
• The profiler disabled path gains no work or state.

Security boundary

Attribution is evidence, not advisory telemetry. Publication must fail closed on inconsistent counters; the repair must establish a coherent read boundary rather than retrying or suppressing a downstream invariant failure.

Implementation landed on main as 928d5797. Focused Debug and TSan tests both pass (2/2): exact accounting plus a deterministic two-writer overlap that rejects partial and one-writer-remaining snapshots. I am keeping this open until the #844 representative quick collector completes end to end with all existing allocation and lock invariants unchanged.

Correction after improving the invariant diagnostic: #845 addresses a real partial-mutation snapshot hazard, but it is not the cause of the representative_weak_collections failure. The exact rejected warmup snapshot is backing-coherent (60,614,174 - 36,184,922 = 24,429,252) while GC-cell lifetime bytes are not (28,463,893 allocated < 33,871,815 freed). My earlier 300-run shell probe accidentally used jq -e final-input status and therefore missed the failing middle phase. The collector remains strict; I am tracing the missing cell-allocation publication separately and will link it here.

Completed by 928d5797, with the independently discovered lifetime-accounting defect repaired by #846 in 61ec0d95. The deterministic two-writer Debug/TSan test proves snapshots reject partial and one-writer-remaining states; the combined source passes the complete representative attribution quick matrix with strict allocation invariants intact.