fix(gc): close the #5029 conservative-scan × evacuation corruption — re-enable write-barrier stress tests

[proggeramlug]

Fixes #5029.

The bug chain (all empirically measured — full trail in the #5029 comments)

The stress suite has been red since #4998 made explicit gc() run the Full conservative native-stack scan. The corruption is real (clone fields read recycled memory), and the root cause is an interaction chain, not a single defect:

1. A stale stack word resurrects a dead old object. The churn loop leaves dead frame slots pointing at a previous round's 256 KB array backing (born directly in old-gen as a large allocation). The conservative Full scan marks it as a trace seed every manual gc().
2. Its slots dangle into recycled nursery memory. The dead array's children were legitimately swept cycles ago; when fresh nursery blocks are later allocated over those freed ranges, the dead object's slots suddenly alias live young objects (pointer_in_nursery flips false→true for unchanged slot bits — measured at panic time: 7710 aliased slots, page-pattern all-clean, manual barrier replay covers instantly).
3. Tracing/evacuating/rewriting through the aliases corrupts the heap, and the old-young-edge verifier reports them as the deterministic missing_edges=7710 signature.
4. Independently, old-page defrag moved objects whose unmarked-old referrers were skipped by the rewrite pass (753 skipped stale referrers measured per evacuating cycle), and one un-rewritable referrer surface remains (codegen raw-pointer globals — GC: old-page defrag unsound on conservative-scan cycles — un-rewritten referrer of moved old objects (class-keys global suspected) #5042).

The four fixes

#	Change	Failure mode it closes
1	Conservative discoveries classified Old are pin-only in minors (CONS_PINNED, no mark/trace seed); full collections keep mark+trace for #4977	resurrection-tracing through dangling slots; the phantom verifier signature
2	rewrite_heap_objects / verify_heap_objects no longer skip unmarked non-nursery objects (unmarked ≠ dead outside the nursery in a minor)	un-rewritten old→old referrers of evacuated targets
3	restore_surviving_dirty_coverage(): post-clear remembered-set repair using the same walk the verifier uses (address-validated before any header deref — the reclaim unit tests seed synthetic entries)	coverage drops the from-scratch rebuild could disagree on; the copying-path to-survivor re-remember gap (ptrs.decode_bits → None for to-space children)
4	Old-page defrag skipped on conservative-scan cycles (copying minors never scan conservatively, so steady-state defrag is unaffected)	moved old objects with un-rewritable referrers — containment until #5042 lands

The two stress tests are re-enabled (they were #[ignore]d in #5033 to unblock CI).

Why a live old object loses nothing from fix 1

Its real old→young edges are barrier-covered: measured ~60k mark_dirty_old_page calls per inter-cycle window, all landing on the right pages — minors only ever find old→young edges through the remembered set anyway. Retention doesn't need the mark (minors don't sweep old-gen), and CONS_PINNED already blocks every evacuation path.

Validation

• gc_write_barrier_stress: 2/2, repeated ×4 runs (re-enabled)
• Standalone repro matrix: 23/23 clean across FORCE_EVACUATE+VERIFY_EVACUATION, PERRY_CONSERVATIVE_STACK_SCAN=full, default knobs, PERRY_GEN_GC=0, PERRY_GEN_GC_EVACUATE=0
• GC unit suite: 377/377; full perry-runtime lib green (single known macOS-local date/timezone flake, green in Linux CI)
• perry bin + integration suites green (one auto-optimize archive cache race under concurrent cargo, passes serially)
• Behavioral smokes: compilePackages: class extending React.PureComponent doesn't inherit isReactComponent on its prototype (2-level chain) → react-reconciler treats error boundaries as function components → children dropped (blocks ink) #5024 gap test byte-identical to Node; clone/probe programs clean through all rounds under stress knobs

Follow-up

#5042 — register codegen raw-pointer globals (perry_class_keys_* et al.) as mutable roots, then lift the fix-4 defrag gate and extend PERRY_GC_VERIFY_EVACUATION to walk those tables.

No version bump / changelog — maintainer folds metadata at merge.