fix(runtime): thread-safety hardening for cross-thread runtime statics

[TheHypnoo]

Summary

perry/thread workers run user JS code on background OS threads. The runtime exposed several process-wide static muts touched on every allocation, throw, and dispatch — concurrent worker code raced on shared mutable state, and stored arena-local pointers that became use-after-free when the originating thread exited.

This PR partitions the offending state per-thread (or per-process where pointer-identity must be global), with no codegen changes — every static mut removed was grep-confirmed unreferenced from crates/perry-codegen.

Before / After

#	Issue	Before	After
1	INTERN_TABLE (8K entries)	static mut, racy &mut INTERN_TABLE[slot] on every property-name allocation; cross-thread reads returned foreign-arena pointers	thread_local! UnsafeCell; per-thread GC scanner sees only its own table
2	TRANSITION_CACHE_GLOBAL (16K entries)	Same — raced under concurrent object construction; comment claimed codegen inlined against the #[no_mangle] symbol but grep showed zero codegen refs	thread_local!; dead #[no_mangle] export removed
3	Exception state (JUMP_BUFFERS[128], TRY_DEPTH, CURRENT_EXCEPTION, HAS_EXCEPTION, IN_FINALLY)	5 process-wide static muts; concurrent throws raced on the depth counter and longjmp'd into stack frames that belonged to other threads	Single ExceptionState struct in TLS; js_throw releases the TLS borrow before longjmp; per-thread GC scanner roots current_exception
4	SMALL_INT_CACHE (Number→string)	static mut of arena pointers; cache populated on thread A handed back invalid pointers on thread B	thread_local!; pinned StringHeaders per thread
5	HANDLE_METHOD_DISPATCH / HANDLE_PROPERTY_DISPATCH / HANDLE_PROPERTY_SET_DISPATCH	static mut Option<fn> written once at startup, read from many threads without synchronization	AtomicPtr<()> with Acquire/Release; safe accessors handle_method_dispatch() etc.
6	Symbol.for / well-known symbol descriptions	Box::leak'd SymbolHeader carried a *mut StringHeader allocated in the calling thread's arena; freed when that worker exited, leaving a dangling pointer in the process-lifetime symbol	New REGISTERED_SYMBOL_DESCRIPTIONS side table (HashMap<sym_ptr, Arc<str>>); readers materialize a fresh StringHeader in the caller's arena on demand
7	arena::ArenaBlock::alloc bump arithmetic	Wrapping + for aligned_offset + size; a hostile size/align pair could wrap and return an in-bounds pointer for an out-of-bounds region	All bump arithmetic via checked_add, matching the slow path that already did this
8	Closure capture write-barrier ordering	Flagged by the audit; on review, callers store-then-barrier with the value rooted on the Rust stack between the two — the existing pattern is correct	No code change; added a SAFETY comment so future maintainers don't try to "fix" it

Test plan

• cargo build --release -p perry-runtime -p perry-stdlib -p perry — clean
• cargo test --release -p perry-runtime --lib — 450 pass; 5 pre-existing flakes in event_pump::tests (timing-sensitive sustained_budget_zero_spin_is_throttled poisons the shared SERIAL mutex; commit ea6d467 already loosened this test once; grep confirms event_pump does not touch any state changed here)
• ./run_parity_tests.sh --filter test_gap_ — 36/37 pass (97.2%); the lone failure is test_gap_class_advanced, a known failure listed in test-parity/known_failures.json for static-class-block lowering, unrelated to runtime statics

Notes

• No Cargo.toml / CLAUDE.md / CHANGELOG.md edits — maintainer handles version + changelog at merge.
• No codegen changes; every removed static mut was grep-confirmed unreferenced from crates/perry-codegen.