Promises: bound host rejection queue draining

[chrisbbreuer]

Parent: #493
Related: #474, #480, #482, #495

Problem

The realm-local unhandled- and handled-rejection queues are growable arrays, but each host checkpoint removes index zero with orderedRemove(0). The private ABI drains those functions in a loop, so N JavaScript-created rejection notifications copy Θ(N²) Promise pointers while repeatedly holding realm_lock. Rejection fanout is script-controlled, making this an avoidable latency and contention surface.

Required implementation

• Replace front-removal with an exact FIFO cursor so each queued Promise is consumed in O(1) amortized work and event order is unchanged.
• Reset the cursor and logical storage as soon as the queue is exhausted, reusing bounded retained capacity rather than retaining consumed logical entries indefinitely.
• Trace and relocate only pending queue entries while preserving precise Promise rooting, early-handled skipping, one-time notification state, and realm-lock synchronization.
• Preserve reentrant behavior: rejection callbacks may enqueue more notifications, which must follow the already-pending FIFO entries and drain in the same checkpoint.
• Do not reverse events, use unordered removal, cap valid fanout, defer required notifications, weaken locking, or add workload-recognizing paths.

Acceptance

• A deterministic wide-queue witness proves dequeue advances a cursor without shifting the backing prefix and resets exactly at exhaustion.
• Unhandled and later-handled notifications retain FIFO order, early-handled entries are skipped, and reentrant enqueues follow pending entries.
• Precise tracing and moving relocation cover pending entries without retaining consumed prefixes as roots.
• Empty, repeated, OOM, teardown, and bounded-capacity lifecycle paths remain exact.
• Focused Promise/private-ABI tests pass in Debug, ReleaseSafe, and suppression-free TSan; relevant threadfuzz and the full unit suite have zero failures/leaks.
• Exact affected Test262 Promise coverage has zero regressions; documentation states the bounded FIFO contract without unsupported throughput claims.

[chrisbbreuer]

Implementation evidence so far:

• The 4,096-entry queue witness passes and proves O(1) cursor advancement, unchanged backing storage during partial drain, FIFO reentrant append, exact exhaustion reset, capacity reuse, empty behavior, and append OOM invariants.
• The private rejection-dispatch witness passes a 64-entry unhandled FIFO plus a reentrant 65th rejection, followed by 64 ordered handled notifications.
• Promise/rejection focused tests pass in Debug and ReleaseSafe; the rejection filter passes under suppression-free TSan.
• Moving-GC relocation proves consumed prefixes are untouched while pending suffixes are rewritten; tracing uses the same pending suffix.
• The pinned Home private ABI passes 392/392 in Debug, ReleaseSafe, and TSan after an audit of 538 symbols (447 implemented, zero pending or unclassified).
• Relevant default threadfuzz passes 400/400. Documentation builds 50 pages and validates 328 links; the manifest change is limited to the updated Home integration page and tree hash.

The full lifecycle threadfuzz profile is currently running because it exposed the independent test-harness race tracked in #875. The full unit suite and exact Promise Test262 coverage remain intentionally unchecked until completed.