fix: test262 runner 进程 RSS 无界增长——session 收尾统一释放内建裸堆区/upvalue 别名 + 每测试分配上限 256MiB（任务 116）

- 泄漏修复：KernelSession 收尾（teardown_intrinsic_protos/free_session_upvalues）
  释放内建对象 Box::into_raw 裸堆区（release_raw_heap 四区置空幂等）与
  session upvalue 原件/晋升克隆别名去重释放；bindings 原生盒负载边、
  session_gc 边记录、vm_props 属性区同步收尾
- 失控测试封顶：runner kernel max_alloc_bytes=256MiB（dispatch 采样口径
  run_alloc_bytes/run_alloc_bytes_full），超限计 memory-limit 失败而非拖垮
  进程 RSS（arena 高水位 GB 级 × 多 worker = 宿主 OOM）
- 归属：RSS 泄漏 pre-existing（HEAD 无 WIP 同现）；identifiers escaped
  unicode 挂死族另立 B132（pre-existing，supervise 超时自愈）
- 验证：build/clippy/四 crate 测试全绿零新增告警；language 前 5000 测试
  单窗峰值 330MB（旧 ~4.5MB/测试 单调增长→88GB OOM 签名消失），
  窗口间峰值 0.17-1.6GB 有界、逐测试释放回基线

crates/oxide_vm/src/promise.rs

@@ -9,7 +9,6 @@
 
 use oxide_kernel::shape_forge::EMPTY_SHAPE_ID;
 use oxide_runtime_api::NativeResult;
-use oxide_types::mem::P;
 use oxide_types::object::{JsObject, NativeFnPtr, PropAttributes};
 use oxide_types::private_key::make_int_key;
 use oxide_types::value::JsValue;
@@ -705,6 +704,7 @@ impl Vm {
         let sf = self.kernel_core.perm_interner().as_ref();
         let sh = self.kernel_core.shape_forge().as_ref();
         let fn_proto_val = self.session.builtin_world().fn_proto_val();
+        let world = self.session.builtin_world();
         let object_proto_val =
             JsValue::from_js_object(self.session.builtin_world().object_proto.as_ptr() as *mut JsObject);
 
@@ -719,7 +719,7 @@ impl Vm {
             &mut proto,
             sf,
             sh,
-            fn_proto_val,
+            world,
             ("then", promise_then as *const (), 2),
             ("catch", promise_catch as *const (), 1),
             ("finally", promise_finally as *const (), 1),
@@ -757,7 +757,7 @@ impl Vm {
             &mut ctor,
             sf,
             sh,
-            fn_proto_val,
+            world,
             ("resolve", promise_static_resolve as *const (), 1),
             ("reject", promise_static_reject as *const (), 1),
             ("all", promise_static_all as *const (), 1),
@@ -768,8 +768,8 @@ impl Vm {
         );
 
         // 固定地址后互相接线：proto.constructor ↔ ctor.prototype。
-        self.promise_proto = P::new(*proto);
-        self.promise_constructor = P::new(*ctor);
+        Self::swap_intrinsic_proto(&mut self.promise_proto, *proto);
+        Self::swap_intrinsic_proto(&mut self.promise_constructor, *ctor);
         let proto_mut = unsafe { &mut *self.promise_proto.as_mut_ptr() };
         proto_mut.set_prop_at(0u32, JsValue::from_js_object(self.promise_constructor.as_ptr() as *mut JsObject));
         let ctor_mut = unsafe { &mut *self.promise_constructor.as_mut_ptr() };
@@ -1169,8 +1169,8 @@ impl Vm {
         ctor.set_data_meta(2u32, PropAttributes::new(false, false, false));
 
         // 固定地址后互相接线：proto.constructor ↔ ctor.prototype。
-        self.aggregate_error_proto = P::new(*proto);
-        self.aggregate_error_constructor = P::new(*ctor);
+        Self::swap_intrinsic_proto(&mut self.aggregate_error_proto, *proto);
+        Self::swap_intrinsic_proto(&mut self.aggregate_error_constructor, *ctor);
         let proto_mut = unsafe { &mut *self.aggregate_error_proto.as_mut_ptr() };
         proto_mut
             .set_prop_at(0u32, JsValue::from_js_object(self.aggregate_error_constructor.as_ptr() as *mut JsObject));