fix: bump WebKit for worker termination and allocator exit

[steipete]

Pin all ten checksum-verified archives from the immutable WebKit release, carrying WebKit #18 and #16. WEBKIT_VERSION derives from the manifest, so the source version, headers and libraries move together.

Worker heap-cap termination previously waited for a signal to catch JavaScript execution while repeated full collections kept the worker in native GC. The engine now invalidates optimized code from the mutator's collection epilogue, letting existing safe points deliver the pending termination. Managed-live accounting, limits, external-buffer exclusions, ERR_WORKER_OUT_OF_MEMORY, and worker-only exit ownership are preserved. The release also fixes the standalone JSC allocator's process-exit TLS race; normal Bun builds use their external allocator. Thanks @dylan-conway for the allocator diagnosis.

The Worker suite adds the retained-object OOM workload and the near-limit survivor with 22 MiB of managed storage plus 64 MiB of external backing storage. The deterministic engine regression blocks the signal sender and requires termination after the first over-cap full GC. WebKit pin changes now select the complete 45-file / 47-row fork suite on Linux; Darwin retains five additional platform rows. When net is selected, CI also executes its complete file directly once and records identity, output and exit status. It collects this receipt even after a grouped failure and preserves both failure gates. The existing test assertions, deadlines and retry policy are preserved.

Validation

Final head: 70a859a63aaa1f6bb4739fbd77a3da6a1058e2df; reviewed tree: dcf6bda55697a7f00f583eac6bd8f48ca728dbeb.

Lane	Required selection	Separate direct net execution	Run
Linux x64	47/47 rows pass	141 pass, 8 skip, 0 fail	37437462957
macOS ARM64	52/52 rows pass	137 pass, 12 skip, 0 fail	37437462957
Windows x64	31/31 rows pass	121 pass, 18 skip, 0 fail	37437462087
Windows ARM64	31/31 rows pass	121 pass, 18 skip, 0 fail	37437462087

The native CI merge tree exactly equals the reviewed head. Windows builds, native smokes, compatibility and manifest pass; archive/executable/profile hashes and native PE architecture were independently checked. These are unsigned test artifacts; signing and publication were skipped. The downloaded macOS CI binary also passes all 16 Worker resource-limit cases against the published engine. Configure-time checks pass 29/29; six synthetic controls verify propagation of grouped and direct failures. Full and final pre-landing P2 Codex reviews are scoped-clean.

WebKit publication passed all 15 jobs on attempt 2. Its raw paired selections pass 46/46 each, the upstream-synced selection passes 85/85, and all nine native heap controls pass. Every public archive and supporting file was downloaded without authentication and verified byte-identical to the candidate. Manifest SHA-256: 0c8ba3498e5b832bd855b90928c9bc4af22712e1403769878b818579f97d6d3f.

Allocator assertion attribution

Publication attempt 1 initially failed should not leak when connect({path}) fails synchronously on a reused handle: aggregate mimalloc pages rose 124→144, exactly the rejected delta 20. The runner then passed the file internally. Investigation attributes this to a pre-existing aggregate-page measurement intermittent: the previous f1e1ca1156 engine itself shows a bounded 45-page jump between equal 32k rounds. With the frozen candidate Bun source, exact adapters and allocator held fixed, each old/new engine passed 250 original-eval and 250 live-allocation trials. A real missing-deref control failed 120/120 trials. The external-allocator boundary and absence of worker-limit traps in this uncapped main-VM fixture were checked.

The exact historical delta-20 sample was not reproduced in 500 eval trials; this is a limitation, not a claim of deterministic replay. It is distinct from the TCP blackhole/RST test issue. Publication attempt 2 passed net in the initial batch in both arms. On this PR's final head, Linux still recovered an initially unregistered net file through the grouped runner; its separate direct execution above supplies additional passing proof. Darwin and both Windows architectures passed their initial net execution and the separate direct check. No net assertion was changed here.

The non-gating Mordant job still reports three resolver findings with continue-on-error: true; its source and configuration are unchanged. Required runtime and support checks pass. The GC-cadence proposal remains outside this release.