ABI: implement the pinned native StringBuilder boundary

[chrisbbreuer]

Parent: #140
Profile parents: #163 and #164

Implement the complete caller-owned native StringBuilder boundary shared by the pinned Home and Bun private-JSC profiles.

Symbols

• StringBuilder__init
• StringBuilder__deinit
• StringBuilder__ensureUnusedCapacity
• StringBuilder__appendLatin1
• StringBuilder__appendUtf16
• StringBuilder__appendString
• StringBuilder__appendLChar
• StringBuilder__appendUChar
• StringBuilder__appendInt
• StringBuilder__appendUsize
• StringBuilder__appendDouble
• StringBuilder__appendQuotedJsonString
• StringBuilder__toString

Acceptance

• Match the pinned 24-byte, 8-byte-aligned caller-owned storage ABI and deterministic init/deinit lifetime.
• Preserve exact UTF-16 content across Latin-1, UTF-16, BunString, LChar, and UChar inputs, including astral pairs and lone surrogates.
• Match pinned integer, usize, and double formatting, including signed zero, NaN, and infinities.
• Match JSON quoting for controls, quotes, backslashes, astral characters, and unpaired surrogates.
• Make capacity arithmetic and allocation failure sticky and failure-atomic; surface OOM from toString without replacing an existing exception.
• Return an exact JS string in the selected realm and keep repeated toString calls non-destructive.
• Exercise malformed/null boundary inputs without stale pointers or double frees.
• Add focused unit/runtime-fixture coverage, update both inventories and profile docs, and publish the new implemented/pending counts in README.md.

Backward compatibility is not a constraint before the first consumer release; prefer the cleanest exact boundary.

[chrisbbreuer]

Complete on main through 52961f98 (implementation a62904a3).

Evidence:

• all 13 pinned StringBuilder__* symbols export with the exact 24-byte/8-byte caller-owned layout;
• focused Debug unit gate: 3/3 passed, zero leaks;
• zig build test-home-private-abi -Doptimize=Debug: Home audit 174/431 with 257 pending, and the expanded consumer fixture passes 173/173;
• Bun core audit: 168/421 with 253 pending;
• public classification audit: 117/117 public, 19 extensions, 178 private/support exports.

The runtime matrix covers Latin-1, tagged UTF-8, exact UTF-16, astral pairs, lone surrogates, owned WTFStringImpl input, integer/usize/double formatting (including -0, NaN, infinities, and 1e21), WebKit JSON quoting, reserve/overflow/OOM, repeated conversion, pending-exception preservation, null/malformed input, and idempotent teardown. README.md and all private-profile/API/Home docs publish the new counts and semantics.