ABI: implement counted private JSValue protection

[chrisbbreuer]

Parent

• Roadmap: implement every README-declared missing runtime surface #134
• ABI: define and implement versioned Bun and Home private-JSC profiles #140
• ABI: implement the pinned Home private-JSC profile #163
• ABI: implement the pinned Bun private-JSC profile #164

Goal

Implement the revision-pinned Home/Bun Bun__JSValue__protect and Bun__JSValue__unprotect boundary exactly: cell values become counted VM roots, primitives are no-ops, and a value becomes collectible only after the matching number of unprotect calls.

Scope

• Export both exact C symbols with the pinned encoded-value signatures.
• Recover the owning VM from private encoded cell handles without requiring a separate global argument.
• Ignore empty, deleted, primitive, invalid-kind, and unmatched unprotect inputs without changing root state.
• Share the existing race-safe counted C-API root table so protection remains correct under precise, moving, and parallel collection.
• Prove double-protect/single-unprotect retention and final-unprotect release under precise GC.
• Exercise both symbols from the independently compiled Home/Bun ABI consumer fixture.
• Refresh both pinned inventories and their drift gates.

Completion evidence

A focused Debug/ReleaseSafe private-ABI run plus the compiled consumer fixture must pass. The expensive full suite remains delegated to the normal batched CI run.

[chrisbbreuer]

Completed on main in 21561474 (feat(abi): count private value protection (#367)). Both exact symbols recover the owning VM from the encoded cell, reuse the race-safe counted C-API root table, ignore primitive/unmatched calls, and retain a cell until the final balanced unprotect. Focused Debug and ReleaseSafe tests each passed 3/3 with zero leaks; the independently compiled private consumer passed 333/333 in both modes. Refreshed inventories report Home 346/471 private implemented (125 pending) and Bun 338/461 (123 pending), both with zero unclassified entries.