ABI: complete JSBuffer allocation and external ownership

[chrisbbreuer]

Parent: #134
Profile umbrella: #140
Home inventory: #163
Bun inventory: #164
Builds on: #215

Implement the remaining pinned core JSBuffer allocation/ownership symbols:

• JSBuffer__bufferFromLength
• JSBuffer__bufferFromPointerAndLengthAndDeinit
• JSBuffer__fromMmap

Acceptance criteria:

• Length construction returns a live Buffer-identified Uint8Array and rejects negative/oversized lengths through the private pending RangeError boundary.
• Pointer construction adopts non-empty bytes without copying and invokes the supplied deallocator/context exactly once.
• Zero-length pointer construction invokes a supplied deallocator immediately, matching the pinned Bun ownership fix, and still returns an empty Buffer.
• Invalid non-empty pointer/deallocator combinations fail explicitly without creating a dangling view.
• Mmap construction adopts the mapping without copying and unmaps it exactly once at GC/realm teardown.
• Allocation failures release transferred external storage and publish the private pending exception.
• Focused engine tests and the Home consumer fixture cover Buffer identity, range failures, pointer identity, callback context, zero length, and mmap teardown.
• Inventories, ABI docs, README scorecard, and parent trackers publish the verified counts without changing benchmark scores for this ABI-only slice.

Completed evidence

Implemented in 90372f3f and documented in f55ec3a8. Focused tests passed 3/3 with zero leaks; the engine and all audits passed; the corrected Home consumer fixture passed 195/195. Home is 196/431 implemented (235 pending), Bun core is 190/421 (231 pending), and the public classifier reports 117 public, 19 extensions, and 200 private/support exports.

[chrisbbreuer]

Completed on main in 90372f3 and f55ec3a. Focused tests: 3/3, zero leaks. Home fixture: 195/195. Home/Bun/public audits are current and green.