Runtime: inventory and audit every engine-created thread

Parent: #502 Related: #476, #481, #482, #490

Problem

Runtime OS-thread creation is spread across $262.agent, concurrent GC, JavaScript Thread, isolated Worker, and the private execution watchdog. There is no machine-readable ownership/lifecycle/admission inventory and no fail-closed boundary preventing a new subsystem from creating an unclassified thread. That blocks #502's first acceptance criterion and makes later CPU-slot/backpressure work guess at the actual producers.

Scope

• Route every production std.Thread.spawn through one typed runtime creation boundary without changing scheduling behavior.
• Check in a versioned machine-readable inventory covering ownership, multiplicity/admission, stack policy, blocking behavior, shutdown/join, scratch/native memory, and coordination status for every resource class and call site.
• Add a standard-library-only audit that reconciles typed production spawn sites with the inventory and freezes all remaining src/ direct spawns as test-only counts.
• Add a named build step and document how to refresh/review the inventory.

Acceptance

• The audit reports zero unclassified production thread creation and rejects an unknown/missing/duplicate typed resource class or direct-spawn count drift.
• The inventory covers $262.agent, concurrent GC marker, JavaScript Thread, Worker script/module, and private execution watchdog, and explicitly records that JIT/Wasm compilation are synchronous today.
• Focused runtime/thread lifecycle tests and the audit pass under normal and TSan builds.
• No scheduling, admission, stack-size, or lifecycle behavior changes in this slice.

Completed on main in 40b1b93. All six production OS-thread creation sites now cross a typed runtime boundary and are reconciled against a versioned ownership/admission/stack/blocking/memory/shutdown inventory. The token-aware audit proves the remaining 141 direct spawn sites are inside top-level tests and rejects injected unclassified direct or typed calls. Validation: full units 2,492 pass/1 skip/0 fail/0 leak; focused concurrent-marker TSan passes; Worker, Thread, GC-marker, and watchdog lifecycle tests pass; C API audit is 117/117 public declarations with 460 private exports; docs build 51 pages with a current manifest.