perf(coro): bound hot scheduler queue audits

[cpunion]

Summary

• make ordinary unlocked Yield/Park handoff validate O(1) owner headers plus the exact completed continuation
• validate only the selected or mailbox-bounded (maximum 8) source prefix during fleet distribution
• drain frozen transfers with O(1) destination headers instead of rescanning unrelated local runnables
• retain complete audits at locked-M, public exact-import, lifecycle, shutdown, test, and diagnostic boundaries
• add corruption gates for distant payloads, local endpoints, and count overflow

Validation

• cd runtime && GOMAXPROCS=2 GOMEMLIMIT=3GiB go test ./...
• native same-source coroutine workload: park/spawn/handoff
• WASI same-source fixture builds and exits successfully under Wasmtime
• host-Go source builds for all coroutine benchmark fixtures

Performance

Exact parent: a3e1a09e2, Darwin arm64, Go 1.26.5, LLVM 19.1.7, process-start GOMAXPROCS=1. Five interleaved 10,000-parked-G runs:

• workload median: 1,904.885 ms -> 157.035 ms (12.13x faster)
• retired instructions: 26.449B -> 6.297B (-76.19%)
• peak RSS: 32,735,232 -> 30,326,784 bytes (-7.36%)
• stripped executable: -176 bytes; segment reservations unchanged

The candidate median is 30,326,784 bytes versus 31,539,200 bytes for the same-source Go build. Incremental resident cost at 10,000 is about 2,261 B/G versus Go 2,802 B/G. Full data and scope are recorded in doc/coro-performance-baseline.md.