vm: stop leaking heap VAL_NULL from json_decode'd dicts

[InauguralPhysicist]

Summary

Two interacting bugs leaked a 128-byte heap VAL_NULL per source dict the first time any null-valued field was accessed:

1. promote_if_arena's VAL_NULL case xcalloc'd a new heap VAL_NULL for the global singleton — ignoring that the singleton (`arena=1`, `refcount=1000000`) is already safe to store anywhere.
2. `slot_bridge_wrap` converted VAL_NULL pointers to an immediate-null slot without decref'ing the owned ref the caller passed in. `DOT_GET` incref'd the dict's heap_null and pushed it; the push silently dropped the +1 ref.

Either fix alone closes the leak; both ship for defense in depth. `slot_from_value` already enforces the same ownership contract — `slot_bridge_wrap` was just missing it.

Minimal repro

```eigs
bools is json_decode of "{"n": null}"
x is bools.n # this access triggers the leak
```

Without the access: no leak (refcounts balance at exit teardown). With any access via DOT_GET, the heap_null gets +1 from `val_incref` and the +1 is stranded by `slot_bridge_wrap`'s pointer drop.

Test plan

• `make asan && cd tests && ASAN_OPTIONS=detect_leaks=1 bash run_all_tests.sh` — 1882/1882, leak tally 13 -> 11
• `make && cd tests && bash run_all_tests.sh` — 1882/1882
• Standalone leakers: 17 -> 15 (retires `test_json_hard.eigs`, `test_ui.eigs`; `test_coverage_v2.eigs` and `test_store.eigs` each lose one heap_null too)
• Minimal repro verified leak-clean

🤖 Generated with Claude Code