Merge train: #9762, #9768–#9797 (11 PRs) + gate follow-ups

[proggeramlug]

Merge train: 11 PRs — #9762, #9768, #9769, #9770, #9771, #9773, #9777, #9779, #9793, #9797 — plus gate follow-ups.

#9762 and a correction

#9762 was held out of train #9798 because it failed tdz_numeric_const_read_is_not_constant_folded, and I reported it as a regression. That was wrong. The emitted IR is call i64 @js_box_get_bits_named(i64 %r3, double %r4) — the TDZ check is intact. #9721 routes the read through a named helper so the thrown ReferenceError can identify the binding, which is the PR's purpose and strictly better. The test hard-codes the old spelling, so a better error message read as a lost guard. My A/B was sound but I inferred the cause from the assertion's wording instead of reading the IR printed directly beneath it. Corrected on the PR.

The test now asserts the property — the read goes through a box, either helper — and additionally that the value is not folded, which it never checked. Sabotage-verified: strip the box call and substitute the fold, it still fails.

The same shape, caught a second time

shape_descriptor_census required family_push_back after slab_mut().insert. #9768 adds family_append_fresh: the same append minus a membership scan that is dead work for an id alloc_shape_id just minted and never reuses. The ordering invariant holds — insert at line 59, append at 65 — only the spelling changed. The census now accepts either and still enforces that the by-id descriptor exists before the reverse accelerator points at it. Also sabotage-verified by inverting the order.

Other gate work

• A break train Merge train: 19 PRs (#9746–#9767) + gate fixes #9798 shipped: tls-budget moved from census.rs (fixed by fix(gc): audit raw TLS holders and pin census snapshot lifetime #9750) to hot_diag.rs (perf(regex): content-keyed construction cache, header-authoritative program lookups, find-only global test #9764's new diagnostics). Converted, along with alloc_census.rs from feat(runtime): PERRY_ALLOC_CENSUS — attribute native-heap bytes to call sites #9771. That made three more holders visible to gc_runtime_root_holders — the intended consequence of gc_runtime_root_holders: raw thread_local! blocks escape classification, and no verdict fits census.rs's PASS1_MARKED #9740's first finding — so CREDIT and LAST_IDLE_PREDICTED_RELEASE are classified as the counters they are.
• intl/segmenter.rs builds its shared keys array inside with_mut_ptr, with every use scoped — including publication into SEGMENT_RECORD_KEYS, for which perf(intl): one shared shape for Intl.Segmenter records — removes the program's largest allocation category #9769 registers a scanner.
• PASS1_MARKED's window re-pinned after perf(intl): one shared shape for Intl.Segmenter records — removes the program's largest allocation category #9769 and feat(runtime): PERRY_ALLOC_CENSUS — attribute native-heap bytes to call sites #9771 touched pinned files. census_take_if_armed_at_full_sweep_start takes the snapshot out of the thread-local BEFORE calling take_census, so feat(runtime): PERRY_ALLOC_CENSUS — attribute native-heap bytes to call sites #9771's feature-gated Rust-heap dump inside it runs after the window has closed; neither change alters mark/sweep control flow.
• Two page_meta.rs band literals allowlisted with justification: synthetic block ranges inside #[test] fn block_range_lookup_respects_gaps_and_ends, not runtime classification.

Validation

64/64 lint gates; release build; perry-codegen, perry-runtime, perry-stdlib, perry-hir, perry-transform — all green (RUST_TEST_THREADS=1).

Not in this train

#9755, #9756, #9774, #9775, #9776, #9780, #9794, #9795, #9796 conflict with train #9798 and are awaiting rebase. Several are independent rewrites of the same code (#9774 vs #9750 on gc_runtime_root_holders.py; #9796 vs the regex.rs split), which is where a mechanical merge goes quietly wrong — better resolved by their authors.