Merge train: #9724, #9712, #9716 (#9254 phases 3-4)

[proggeramlug]

Merge train: #9724, #9712, #9716. Validated once as a tree, rebase-merged so each commit keeps its author.

Note on assembly: #9716 (Phase 4) carries its own rebased copy of #9712's commits, so picking both would duplicate Phase 3. #9716 was picked alone; #9712 lands with it.

#9724 — shape descriptors in an id-indexed slab. Retires the boxed by-id PtrHashMap. The GC invariant is preserved and now pinned harder: since #8112 the collector enumerates each record's keys word as an ordinary GC slot and a budgeted dirty scan can hold that address across mutator resumptions, so a record's address must never move for its lifetime — chunks are individually boxed and never reallocated, only the directory grows.

shape_descriptor_census.py goes from 13 to 17 pinned patterns and adds shapes_store.rs to the set read as one logical unit (citing #8918, where a census inspecting an empty body reported success). I sabotage-tested the gate by breaking type Chunk = Box<…>: it fails with "shape descriptor authority surface missing: slab chunks individually boxed, never reallocated".

#9712 / #9716 — #9254 Phases 3 and 4. One loop-invariant receiver validation is materialized in the preheader, the cached base handle is refreshed after every fired back-edge GC poll, and exact bounded reads take a raw load behind an invariant fast/fallback diamond. Phase 4 then moves the five remaining bespoke receiver mechanisms into ReceiverDescriptorTable.

Admission is default-deny: the shared receiver-region model answers an unmodelled statement with RegionEnder::Unmodelled and an unrecognized relocation point with deny("cached address does not survive this relocation point"). Phase 3's edits to that model are additive; the deny arms are untouched.

Validation

64/64 lint gates; release build; perry-codegen, perry-runtime, perry-hir (all RUST_TEST_THREADS=1), and issue_9254_receiver_descriptor_counted_loop — all green.

Gap suite: 697 tests against the pinned node 26.5.1. These PRs promote previously-lint-only region formation to a production consumer and touch every counted loop over a numeric array, so a full sweep was run rather than relying on unit tests.

Zero regressions attributable to this train. The harness reported ten, all attributed:

• 8 compile failures, every one an http/http2 test — node:http fails to link from a cold auto-optimize cache: js_bun_http_response_snapshot_json is web-fetch-gated but referenced unconditionally #9719, the cold-auto-optimize-cache node:http link failure (js_bun_http_response_snapshot_json is web-fetch-gated but referenced unconditionally). Pre-existing and filed; reproduces independently of this train.
• test_gap_9592_child_timeout_threads — the test spawns /bin/true, which does not exist on macOS (/usr/bin/true does). node fails with spawn /bin/true ENOENT; Perry prints the correct timeout threads released: true / slow child killed on time: true. An oracle failure on this platform, not a Perry one.
• test_gap_9676_stdin_unref_ref_keeps_reader — node_fail; passes under node with </dev/null. A stdin-context artifact of the local sweep.

Both non-http cases were re-run in isolation to rule out CPU contention from the concurrently running cargo suites, then diffed against node by hand.