perf(codegen): inline append tier for Array-subclass elements receivers (−6.8% / −8.4% wolf-ecs) - #8996

What

sub.push(v) on a class X extends Array instance now takes the inline append
tier. The tier's gate splits three ways instead of two:

• a forwarded receiver keeps the runtime arm, unchanged;
• an ordinary GC_TYPE_ARRAY receiver goes straight to the room/integrity tests
  and the inline store, exactly as before — byte-identical IR;
• a GC_TYPE_OBJECT receiver loads its meta record and ObjectMeta.elements
  (word 12) and validates that store — an Array, not forwarded — before the same
  tests and the same inline store run on it, reached through a payload phi.

The store's own header carries the length that is bumped and the flags that are
tested, and it is the write barrier's parent. The binding keeps naming the
receiver, and capacity growth still calls js_array_push_f64_spec with the
receiver so the re-allocated head is published where the runtime expects it.

Why

Since the Array-subclass elements store landed (#8966), the representation of a
subclass instance is a real GC_TYPE_ARRAY hanging off ObjectMeta. But the
inline append tier still declined every non-GC_TYPE_ARRAY receiver — a
deliberate refusal from #7574, because an ObjectHeader overlays ArrayHeader
field for field, so an inline store against an object receiver would have
written over keys_array. That refusal sent every sub.push(v) to
js_array_push_f64 / js_array_push_f64_spec for what is now a single pointer
hop: together 4.2% of the wolf-ecs entity cycle.

This is the append half of the same fix #8976 made for pop.

Numbers

Mac mini (perry@perry-macos.local, load ~1.5), 11 alternating pairs against
main at 4b9dde9, both benchmarks in both windows:

Testing

• RUSTFLAGS=-D warnings cargo check --workspace --all-targets — clean.
• perry-codegen suite, including all 15 array_push IR tests.
• perry-runtime --lib.
• Integration: issue_8655_array_subclass_indexing,
  issue_8773_closure_capture_packed_loops, issue_8690_loop_versioned_arraylike,
  issue_5898_array_pop_prototype, array_subclass_fill_args,
  issue_8897_field_push_writeback.
• Lint gates: shape-descriptor census, address-class inventory, GC store-site
  inventory, file size, raw-handle debt, local-binding audit.
• Differential probes against node: subclass-semantics, subclass-heavy,
  fill-args, elem-loop — no divergence introduced (the two pre-existing
  Symbol.species constructor.name differences are unchanged).

Summary by CodeRabbit

• Performance
  • Improved push() performance for eligible Array subclasses by enabling a faster inline append path.
  • Preserved existing behavior for growing arrays, forwarded receivers, and special array configurations.