perf(vm): 字符串拼接用 push_to_string 消去中间分配, GC阈值 8M→32M

- oxide_runtime_api 新增 push_to_string: 直接将 JsValue 写入 String buffer
- dispatch_add / dispatch_compound_add 复用 Vm::string_buf, 每次concat从4次分配降到1次
- vm_support 新增 new_string_owned 接受 String 转移所有权
- kernel session_gc_threshold 8MB→32MB 减少频繁 GC
- build.sh: make clean 清跨平台 .obj 残留

(cherry picked from commit ad7b044a5a24b23819d783c5419d3e33f936dfc5)

crates/oxide_vm/src/vm_support.rs

@@ -69,6 +69,7 @@ impl Vm {
                 ic_misses: std::cell::Cell::new(0),
                 instruction_count: 0,
             },
+            string_buf: String::new(),
         };
         vm_info!("Vm created");
         vm
@@ -127,6 +128,7 @@ impl Vm {
                 ic_misses: std::cell::Cell::new(0),
                 instruction_count: 0,
             },
+            string_buf: String::new(),
         };
         vm_info!("Vm created (pool)");
         vm
@@ -220,9 +222,15 @@ impl Vm {
     }
 
     pub fn new_string(&mut self, s: &str) -> JsValue {
-        let ptr = Box::into_raw(Box::new(JsString::new(s.to_string())));
+        self.new_string_owned(s.to_string())
+    }
+
+    /// Same as `new_string` but takes `String` by move, avoiding a clone.
+    pub fn new_string_owned(&mut self, s: String) -> JsValue {
+        let len = s.len();
+        let ptr = Box::into_raw(Box::new(JsString::new(s)));
         self.gc_state.session_string_ptrs.push(ptr);
-        self.gc_state.session_bytes_allocated += std::mem::size_of::<JsString>() + s.len();
+        self.gc_state.session_bytes_allocated += std::mem::size_of::<JsString>() + len;
         JsValue::string(ptr)
     }