Shape tree C3 codegen remainder: eager shape-id stamping + PIC id compare (#6759/#6798)

[proggeramlug]

The runtime half of #6759 Phase C3 landed via #6801 + #6803 (stable process-global shape ids, header stamps in parent_class_id for plain objects, id-keyed FIELD_CACHE, PIC shared-only priming). This issue tracks the codegen remainder, which per the plan (docs/shape-tree-plan.md, "C3-codegen") gets its own design review before landing:

1. Eager stamping at allocation: codegen knows the literal shape at compile time (the transient shape_id → prebuilt keys_array machinery); stamping parent_class_id at inline allocation makes ids present from birth. This unblocks typed_feedback::object_shape() canonicalizing its observation token on ids — with LAZY stamping, pre-stamp and post-stamp observations of one logical shape produce two tokens per site and read as spurious polymorphism (why perf(runtime): #6759 C3c-r — header-stamped stable shape ids, id-keyed FIELD_CACHE, PIC ABA fix #6803 deliberately left the token on the keys address; see the note in object_shape).
2. PIC compares the header id: the per-site cache holds (shape_id, slot) and the emitted IR compares the u32 at header offset 8. Needs a discriminated compare: the generic PIC also serves class instances (e.g. the World.commandBuffer case in ic_miss.rs), whose parent_class_id is real inheritance data — the id range (0x8000_0000..0xC000_0000, disjoint from all class ids) makes the discrimination a single range test, but the class-instance arm must keep the keys-pointer compare. ILP32 note: offset-8 u32 loads are fine on arm64_32; do NOT fuse into a 4-aligned i64 load (i64:64 datalayout).
3. Transition edges shape-resident: fold the transition cache's (prev_keys, key) → (next_keys, slot) edges onto ids once both ends are stamped eagerly.

Acceptance: the #6759 micro table (read/write/define/in/Object.keys ≤1.5× node; babel-class init ≤2× node), measured against the merged #6800–#6803 baseline.

[proggeramlug]

Both halves are merged:

• perf(runtime): #6804 — eager ShapeId stamping + canonical typed_feedback tokens #6807 — eager ShapeId stamping (shape-cache-carried birth stamps, dynamic-shape birth stamps, PIC-miss stamps, self-healing object_shape()) + canonical id tokens for typed_feedback, with the token/address couplings untangled (including the typed-feedback GC scanner no longer visiting id tokens as heap addresses).
• perf(codegen): #6804 — PIC compares the discriminated shape token + slot bounds check #6808 — the PIC compares the discriminated shape token (ShapeId | 1<<62 for stamped plain objects — collision-free with pointer tokens by construction, ABA-immune, re-enabling owned-keys caching; keys pointers for class instances) + the hit-path slot bounds check that closes the latent same-shape/different-capacity over-read.

Transition-cache edges deliberately stay address-keyed (validated per hit); folding them onto shape-resident edges is deferred until profiling shows the validation cost matters — noted in docs/shape-tree-plan.md §C3-codegen.

Validation: runtime suite 1453/1453 at each step; PIC smoke byte-identical vs node --experimental-strip-types across the seven token/bounds scenarios (#6808 comment); cargo-test + e2e-scoped + conformance shards green in CI. CodeRabbit's one finding on #6807 (raise the bounds floor to 8) was rejected as unsound — the weakest allocator guarantee is max(field_count, 4), and the bound must never exceed physical capacity (rationale on the PR).

Remaining measurement against the #6759 acceptance table (read/write/define/in/Object.keys ≤1.5× node; babel-class ≤2×) is a benchmarking task on the merged baseline, not an implementation gap. Closing.