ABI: implement true uninitialized Uint8Array allocation

[chrisbbreuer]

Parent: #134
Profile umbrella: #140
Home inventory: #163
Bun inventory: #164
Builds on: #215 and #216

Implement the pinned private-JSC symbol:

• JSC__JSValue__createUninitializedUint8Array

Acceptance criteria:

• Return a live ordinary (non-Buffer) Uint8Array in the selected realm with the exact requested length.
• Allocate genuinely uninitialized backing storage instead of routing through the normal ECMAScript zero-filled constructor path.
• Keep uninitialized allocation internal to this explicit ABI; ordinary JavaScript typed-array construction remains zero-filled.
• Reject oversized lengths through the private pending RangeError/OOM boundary without publishing a partial object.
• Preserve GC byte accounting, alignment, finalization, and leak behavior for both arena and GC-backed contexts.
• Focused tests and the Home consumer fixture verify type/length, writable independent storage, ordinary Uint8Array identity, failure behavior, and public accessor compatibility without asserting nondeterministic initial bytes.
• Inventories, ABI docs, README scorecard, and parent trackers publish the verified counts; benchmark results change only if a committed benchmark path is rerun.

Completed evidence

Implemented in 6662df91 and documented in 4554eeb3. The focused test passed 3/3 with zero leaks; the batched engine/consumer/audit gate passed 15/15; the Home consumer fixture passed 196/196. Home is 197/431 implemented (234 pending), Bun core is 191/421 (230 pending), and the public classifier reports 117 public, 19 extensions, and 201 private/support exports.

[chrisbbreuer]

Completed on main in 6662df9 and 4554eeb. Focused tests: 3/3, zero leaks. Batched verification: 15/15. Home fixture: 196/196. Home/Bun/public audits are current and green.