Merge train: 19 PRs (#9746–#9767) + gate fixes

[proggeramlug]

Merge train: 19 PRs — #9746, #9747, #9748, #9749, #9751, #9752, #9753, #9754, #9757, #9758, #9759, #9760, #9761, #9763, #9764, #9765, #9766, #9767, #9750. Validated once as a tree, rebase-merged so each commit keeps its author.

#9762 is not in this train and is landing in the next one — see the note at the end.

Gate work

Five gates went red together; each is fixed at source rather than baselined away. All five were verified green on clean main first, so none had a pre-existing excuse.

• ic_miss.rs (fix(runtime): #9192 — an array with a non-array [[Prototype]] inherited nothing (47 divergences from node → 19) #9219 class). perf(regex): content-keyed construction cache, header-authoritative program lookups, find-only global test #9764's new #[cold] IC-miss diagnostic guarded a key pointer with a bare < 0x1000 floor, which admits the whole handle band — real addresses on Linux, hidden by macOS's higher mmap base. Now asks addr_class::is_above_handle_band.
• Six raw-handle reads in bun_compat/jsc.rs, class_registry/construct.rs and construct/class_object.rs moved into with_mut_ptr (gc(layer 3): from-space quarantine catches 55 stale dereferences across the gap suite — the instrument is in CI but aimed at one synthetic fixture #7341).
• IC_DIAG and REGEX_DIAG classified. REGEX_DIAG's entry records that its per_pattern key is a pattern StringHeader address used only as an opaque grouping id, never dereferenced — and that a recycled address merges two rows' counters. That imprecision is written down rather than papered over.
• PASS1_MARKED's non_moving_snapshot pin re-audited. fix(gc): audit raw TLS holders and pin census snapshot lifetime #9750's new gate correctly demanded review because feat: implement bun:jsc heapStats with Perry heap counters #9760 touched gc/mod.rs. That change is mod heap_stats; plus a re-export and alters no mark/sweep control flow; heap_stats() runs only from the JS-facing bun:jsc.heapStats(), never inside a cycle, and its own contract forbids allocation during the walk. Window unchanged, so only that one file's digest was re-pinned.
• String payload-access ratchet moved the good way (358 → 353) and its baseline is recorded.

Other train fixes

regex.rs crossed the 2000-line cap, so escape_regexp_source moved into the existing regex/escape.rs and flags validation into a new regex/flags.rs — both gated on regex-engine like their siblings. (A --features regex-engine check passes while the default build fails, since both moved items sit behind that gate; worth knowing before trusting a single-configuration check.)

Two docs conflicts, resolved by kind: #9759's prose kept both independent sections; #9763's docs/api/perry.d.ts and docs/src/api/reference.md are generated ("Do not edit by hand"), so they were regenerated from the manifest rather than merged.

Validation

64/64 lint gates; release build; perry-codegen, perry-runtime, perry-stdlib, perry-hir, perry-transform — all green (RUST_TEST_THREADS=1).

On #9762

It failed tdz_numeric_const_read_is_not_constant_folded, and I initially reported it as a regression. That was wrong: the emitted IR contains call i64 @js_box_get_bits_named(...), so the TDZ check is intact — the PR routes it through a named variant so the ReferenceError can identify the binding. The test hard-codes the old helper spelling. Corrected on the PR, and the test is being fixed to assert the property rather than the spelling (plus the no-fold assertion it was missing) in the next train.