fix(gc): restore the census-pinned carrier expression in the shape scanner - #8918

…ber (#8919)

It landed as #8918, not #8917, and #8917 is a different open PR — fragment
filenames are PR-keyed precisely so in-flight PRs cannot collide.

Co-authored-by: Ralph Küpper <ralph@skelpo.com>

…plit the file

- `lookup` collided with `buffer/view.rs::lookup` in the root-holder gate's
  loose IDENT graph, which is module-blind past depth 0, so view.rs's body text
  (containing VIEW_REGISTRY) counted as reachable and the holder flipped to
  COVERED. Renamed to `lookup_ways`.
- `test_clear_shape_table` dropped every descriptor box while invalidating
  nothing, leaving dangling ways for any clear-then-lookup in tests.
- Extracted the cfg(test) helpers to a sibling file (2057 -> 1933 lines).
- Re-applied PerryTS#8918's census-pinned carrier literal, which this branch's merge
  had reverted.

…ble (#8917)

* perf(shapes): direct-mapped cache in front of the shape-descriptor table

shape_descriptor_by_id is on the hot property path — it and
shape_descriptor_ensure_with_generation are ~13% of main-thread samples
between them on a dynamic property loop — and every call paid a TLS
fetch, a RefCell borrow and a hash probe to reach a record whose address
never moves. Box<ShapeDescriptor> is stable across rehash, so a 256-way
direct-mapped cache holds the record's address and a hit is mask,
compare, deref. 4 KiB per thread, fixed.

Caches the ADDRESS, not a copy: records are mutated in place
(old_carrier, cache_carrier, keys after evacuation), so a cached copy
would go quietly stale.

Epoch invalidation is selective. Removal frees the box, and one insert
path can replace a live id with a fresh box; both bump. A fresh-id insert
deliberately does not — it cannot invalidate an existing way, and bumping
there would flush the cache on every shape creation.

Measured (idle host, min of 7): overwrite-only 1088ms -> 955ms, -12.2%;
delete-heavy 1222ms -> 1187ms. Short of the 13% of samples because only
by_id is served; ensure_with_generation still probes. Perry remains ~50x
node on this loop — the rest is js_array_get_f64 (324) and
try_read_tracked_gc_header (307), untouched here.

Invalidation test sabotage-checked: a stale way is a dangling pointer to
a dropped box, not a wrong answer.

Suite 2759 passed.

* fix(shapes): unblock the lookup cache — rename the colliding ident, split the file

- `lookup` collided with `buffer/view.rs::lookup` in the root-holder gate's
  loose IDENT graph, which is module-blind past depth 0, so view.rs's body text
  (containing VIEW_REGISTRY) counted as reachable and the holder flipped to
  COVERED. Renamed to `lookup_ways`.
- `test_clear_shape_table` dropped every descriptor box while invalidating
  nothing, leaving dangling ways for any clear-then-lookup in tests.
- Extracted the cfg(test) helpers to a sibling file (2057 -> 1933 lines).
- Re-applied #8918's census-pinned carrier literal, which this branch's merge
  had reverted.

---------

Co-authored-by: Ralph Küpper <ralph3@skelpo.com>
Co-authored-by: Ralph Küpper <ralph@skelpo.com>