ABI: expose exact accessor cells during non-indexed property traversal

[chrisbbreuer]

Parent: #140
Tracked by: #134, #163, #164

Implement exact non-indexed private property traversal together with the GetterSetter/CustomGetterSetter cells it exposes. These cannot be split honestly: upstream traversal returns accessor descriptor cells without invoking ordinary getters, and consumer code then classifies/casts those cells before calling the four null predicates.

Acceptance

• Add exact GC-owned GetterSetter and CustomGetterSetter cell kinds with profile-selected JSType tags 7 and 8, strong tracing of callable getter/setter values, and no user-observable ordinary-object behavior.
• Implement the generated bun.cpp classification boundary used by JSValue.isGetterSetter / isCustomGetterSetter and preserve the checked JSCell cast path.
• Implement JSC__GetterSetter__isGetterNull, JSC__GetterSetter__isSetterNull, JSC__CustomGetterSetter__isGetterNull, and JSC__CustomGetterSetter__isSetterNull against the exact descriptor slots.
• Implement JSC__JSValue__forEachPropertyNonIndexed over own non-index string and Symbol keys only, with pinned ordering, duplicate suppression, length/index/internal-key filters, and exact key flags.
• Match JSC value behavior: return descriptor cells for non-cacheable accessors without invoking them, read eligible data/custom values, ignore property-get exceptions where upstream clears them, and propagate callback-published exceptions immediately.
• Preserve same-VM/sibling identity, reject invalid or foreign inputs without memory unsafety, and keep descriptor/getter/setter cells precise across callback-triggered GC and reentry.
• Cover enumerable/non-enumerable data, getter-only/setter-only/both/neither descriptors, custom accessors, Symbols/private keys, arrays/length/index filtering, proxies, callback throws, GC, reentry, and existing pending exceptions in focused and compiled consumer tests.
• Mark all five Home-inventoried exports and the three shared Bun-inventoried exports implemented, preserve zero unclassified entries, and update README/private ABI evidence.

Evidence

• Runtime: b7f98611
• Documentation: de9303ba
• Unit suite: 987/987 passed, 0 leaked
• Compiled Home fixture: 270/270 linked; runtime matrix passed
• Home inventory: 269/431 implemented, 162 pending, 0 unclassified
• Bun inventory: 261/421 implemented, 160 pending, 0 unclassified
• JSType fixture: 20 exact cell kinds
• C API audit: 117/117 public complete; 276 classified private-profile exports
• The ABI-only slice does not enter the published benchmark workloads; README retains the validated 1,540-sample July 17 matrix.

[chrisbbreuer]

Implemented and documented on main in b7f9861 and de9303b. All acceptance checks and evidence are recorded in the issue body; 987/987 unit tests and the 270/270 compiled Home fixture pass.