ABI: implement Uint8Array constructors and Buffer identity

[chrisbbreuer]

Parent: #134
Profile umbrella: #140
Home inventory: #163
Bun inventory: #164

Implement the pinned private-JSC Uint8Array constructor/identity boundary as real live objects rather than link-only shims:

• Bun__createUint8ArrayForCopy
• JSUint8Array__fromDefaultAllocator
• JSBuffer__isBuffer

Acceptance criteria:

• Return a live Uint8Array in the selected realm with the requested length.
• Copy constructor copies non-null input and supports empty input.
• Null copy input with non-zero length yields writable backing storage without reading the null pointer.
• buffer=true records durable Bun Buffer identity and JSBuffer__isBuffer distinguishes it from ordinary Uint8Array values and non-cells.
• Default-allocator constructor adopts non-empty bytes without copying and releases them exactly once with mi_free.
• Standalone zig-js builds provide a weak libc-backed mi_free fallback; a consumer's strong mimalloc symbol wins when present.
• Allocation/VM failures return the empty encoded value and publish the private pending exception.
• Focused engine tests and the Home private consumer fixture cover copy isolation, null allocation, Buffer identity, zero length, pointer identity, and release-once behavior.
• Home/Bun inventories, ABI docs, README scorecard, and parent trackers publish the new evidence and counts.

Completed evidence

Implemented in d50972ff and documented in 3b09f171. Focused tests passed 3/3 with zero leaks; the batched engine/consumer/audit gate passed 15/15; the Home consumer fixture passed 192/192. Home is 193/431 implemented (238 pending), Bun core is 187/421 (234 pending), and the public classifier reports 117 public, 19 extensions, and 197 private/support exports.

[chrisbbreuer]

Completed on main in d50972f and 3b09f17. Focused tests: 3/3, zero leaks. Batched verification: 15/15. Home fixture: 192/192. Home/Bun inventories and README evidence are current.