Strings: retain StringData through String construction

[chrisbbreuer]

Parents: #473, #480
Related: #666, #777

Problem

The global String function always converts its result to canonical WTF-8 bytes and constructs a new StringCell. When the argument is already a String primitive, or object coercion produces one, ECMAScript ToString already has the exact immutable result Value. Re-encoding and rewrapping it adds avoidable allocation; with active flat Latin-1 storage it also adds an avoidable physical-to-canonical transcode.

new String(value) repeats the same string allocation before allocating the required wrapper object. The zero-argument path also allocates an empty StringCell despite the engine static empty-string value.

Scope

• Retain the exact StringData Value for primitive string inputs and object coercions that produce strings.
• Reuse the static empty string for the zero-argument call and construction paths.
• Preserve String(symbol) descriptive-string behavior and the new String(symbol) TypeError.
• Preserve constructor prototype and wrapper String exotic semantics.
• Add allocation-exact witnesses for called and constructed flat Latin-1 paths.

No-workaround rules

• No storage forcing, hidden canonical copy, replacement characters, special input cache, or weakened WTF-8 validation.
• No stacks, queues, jobs, Promise, Worker, or Map/Set iterator changes.

Acceptance

• Called String returns the existing StringData cell when ToString already yields one.
• Constructed String boxes that exact StringData cell and allocates only the required wrapper.
• Empty and Symbol semantics remain exact.
• Focused normal/TSan units, relevant Test262 accounting, and the full unit gate pass without regressions.

[chrisbbreuer]

Implementation landed on main in a0e184e9.

• String(value) now returns the exact StringData Value when ToString already yields a string; the checked flat Latin-1 call performs zero allocations.
• new String(value) boxes that exact cell and the checked path performs exactly the three allocations intrinsic to the wrapper object, storage state, and cold sidecar.
• The zero-argument path reuses the static empty string. Direct String(Symbol) and constructed-Symbol behavior remain on their distinct spec paths.
• Exact-parent Test262 test/built-ins/String: 1,223 -> 1,223 pass, 0 fail, 0 flips.
• Focused witness: 1/1 normal and 1/1 TSan, with zero leaks or sanitizer reports.
• Threadfuzz default: 400 programs from seed 1, zero failures.

The issue remains open pending the full unit gate on a clean host. The currently active unrelated Home/Bun Zig jobs make another full run unreliable, and the same eventual green run can close #778 and #779.

[chrisbbreuer]

Acceptance is complete. Clean main CI run 33071676798 passed all four ordinary unit shards at 872dbbb5; the issue-specific focused normal/TSan/OOM, exact-parent Test262, allocation, and deterministic fuzz evidence is recorded above. Closing with no semantic regressions.