fix(runtime): module-env binding creation vs worker resolve data race (#607)

[InauguralPhysicist]

Closes #607

The bug

Main-thread module code creating a new global while spawned workers run could realloc the module env's names/values/assign_counts arrays or rebuild its hash buckets — freeing blocks a concurrent worker env_resolve_chain walk or post-resolve slot load was still reading. Use-after-free class, latent since spawn landed, hidden by bucket-collision luck; #602's +3 builtin registrations shifted the module-env layout so a grow landed inside test_concurrent's MT window and the TSan gate went deterministically red (2/2 CI runs on PR #606; reproduced locally with full stacks — reader env_resolve_chain eigenscript.c:1882 / vm_run_ex vm.c:2837 in a worker vs writer env_set_local_pre_interned_slot eigenscript.c:1788-89 on main).

The fix (all gated on g_vm_multithreaded — single-threaded programs pay only predicted-false branches)

1. g_module_env_lock serializes module-env (parent == NULL) structural mutation against the module-env hop of every chain walker.
2. Grown-out arrays are retired on the env (freed at park/destroy; waste bounded <2x by geometric doubling) so post-resolve loads outside the lock can never touch freed memory.
3. values/assign_counts pointers are published with release stores and read at the post-resolve VM/JIT sites via env_values_ptr/env_assign_counts_ptr (acquire). IC fast paths stay plain — a worker never fast-path-hits the module env (ICs never populate under MT per Data races: parallel workers executing the same shared chunk (exec_count, JIT counters, inline caches, shared-env refcounts) #297) and main is the grower itself.
4. env_store_slot takes the lock so a worker's global reassign can't land in a retired copy (lost update).

Out of scope (pre-existing, separate class): two threads racing on the SAME slot's value/assign-count — slot-value semantics, not array memory safety.

Validation

• Red-then-green: with the Bulk PCM16LE codec builtins: buf_from_pcm16le / buf_to_pcm16le / buf_deinterleave (DAW WAV import is per-sample interpreted) #602 builtins present, test_concurrent reported 4 TSan warnings without the fix, 0 across 3 runs with it; full tests/test_tsan.sh slice 10/10 including the seeded-race self-validation.
• Release suite 2880/2880; ASan/UBSan detect_leaks=1 leak tally 0 (single [97] failure = the known invariant_weak 60 s wall-guard marginality under ASan on the N3350, 71 s in isolation, unrelated).
• make jit-smoke and make freestanding-check green.

Unblocks #606 (PCM codec kernels) and the #603 resample PR.

🤖 Generated with Claude Code