Implement a NativeScript-backed node:vm builtin and land the runtime fixes
needed to keep both V8 and QuickJS aligned across CommonJS, ESM, and runtime
execution paths.

Node vm support
- add the NativeScript-backed vm runtime module and expose require("vm") /
  require("node:vm") from the internal Node loader
- implement vm.createContext(), vm.isContext(), runInContext(),
  runInNewContext(), runInThisContext(), Script, compileFunction(),
  SourceTextModule, SyntheticModule, measureMemory(), and vm.constants
- preserve caller-provided receivers in vm.compileFunction() while keeping plain
  calls strict so they do not leak the ambient global object into parsing
  contexts

ESM and module loader parity
- add builtin ESM bridges for node:vm in both the V8 and QuickJS loaders so
  dynamic import("node:vm") resolves the same surface as require("node:vm")
- initialize the QuickJS ES module loader during module bootstrap and resolve
  builtin/native modules through virtual module sources with import.meta support
- extend vm CLI coverage to assert compileFunction receiver semantics and
  dynamic import("node:vm") on both engines
- move the dynamic import coverage earlier in the CLI test to avoid a separate
  QuickJS logging quirk triggered after the module-evaluation block

QuickJS runtime and N-API fixes
- preserve exact script length when evaluating strings with embedded NUL bytes
- fix plain-call constructor handling in napi_define_class()
- switch internal wrap/type-tag storage to symbol-backed properties
- fix uint32/uint64 creation paths and string extraction behavior
- retain weakref targets until the host job completes
- normalize QuickJS property access errors to modern message text

Objective-C bridge and marshalling fixes
- thread napi_env through Closure construction
- harden bridge object lifetime/ref management and FunctionReference branding
- add Float16 conversion support and correct metadata encoding for UInt8

URL and web runtime fixes
- fix URL-backed URLSearchParams creation so V8 method dispatch works correctly
- reject invalid fetch inputs via promise rejection and clean up abort listeners

Verification
- macOS CLI vm test on V8: pass
- macOS CLI vm test on QuickJS: pass
- full runtime suites were previously exercised on macOS/iOS for both engines

- integrate prebuilt Hermes artifact downloads into the local build flow and macOS test harness
- switch the Hermes N-API runtime over to the thread-safe runtime path and drain microtasks fully
- harden bridge constructors, pointer/reference handling, closure teardown, timers, URL constructors, and object conversion for Hermes semantics
- add Hermes-compatible node:vm shims, keep compileFunction receiver behavior, and expose node:vm through the builtin ESM bridge
- extend runtime tests for vm import/receiver coverage and relax engine-specific expectations where Hermes lifetime behavior differs but runtime state is verified

Attach struct type encodings directly to generated struct constructors so JSC can resolve record types consistently during reference construction.

Stabilize the timer cleanup coverage by exposing the native active timer count and using that on iOS JSC instead of relying on weak reference collection timing.

Also replace NSString version comparison in VersionDiffTests with engine-agnostic numeric parsing so the coverage path no longer depends on platform-specific compare helpers.

Add the remaining runtime engine work across JSC, QuickJS, and the Objective-C bridge, including the node:vm implementation, builtin module resolution updates, object/class/reference marshalling fixes, and engine-specific Node-API hardening.

Also add the CLI memory semantics suite and harness updates covering weak references, finalization, Objective-C ownership rules, block callbacks, C function pointers, pointer buffers, and reference lifecycle behavior so the runtime’s memory model is exercised from JavaScript.