gc tests: root the key tables in the residual prototype tests (#12137)

[proggeramlug]

Closes #12137.

This was a test isolation bug, not a region-manager bug.

• CopyingNurseryTestGuard starts with an empty root-scanner set. Inside that window the residual-prototype tests call Object.setPrototypeOf/getPrototypeOf on builtin owners, which lazily builds intrinsics and creates key atoms in the thread's atom table (ATOMS, string/intern.rs).
• Production roots that table through scan_intern_table_roots_mut (intern.rs:589), but the window never registered it. A copying minor freed the atoms while the table still named them.
• The next intrinsic build (populate_global_this_builtins → canonicalize) then published a canonical key list with freed addresses as keys.
• key_bytes_hash read a garbage length of about 2 MB and ran off the end of its block into the gap after the 2 MiB region. Since gc: Perry-owned memory for GC arena blocks (2 MiB OS regions, huge pages by complete units) #12132 that gap faults; before, the same read was probably a silent garbage read.
• With ASLR off it fails every time; with ASLR on it failed 18 of 40 runs when run alone.

The fix registers the atom/intern, shape-table rekey and canonical-keys scanners in these tests, the same set runtime_roots/function_attrs_old_minor.rs uses.

Verification:

• The module ran 60 times with 0 failures, with ASLR on and off.
• The full debug gc::tests sequence ran 10 times with no SIGSEGV. z8_churn was skipped because it hits debug builds: z8 stream churn test panics with 'attempt to subtract with overflow' at array/storage.rs:32 #12136 first.
• Two debug failures also occur on unpatched main: perex_lifecycle.rs:247 and regexp_last_index.rs:211.
• The release serial runtime suite passes 5208/0.

Separate note for the shape owner, not fixed here and not shown to cause anything in production: the canonical-keys trie is weak, and young canonical key lists are only pruned at a full collection (young_prune: None at gc/dead_owner.rs:434). A list that dies in a minor stays in the trie until the next full collection.

[coderabbitai]

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}