[blacktrs]

Part of #600 (Laravel follow-up). This PR cuts build memory and per-request leaks, and fixes two Laravel regressions from #599.

Results (macOS arm64)

	before	after
clang codegen, one 330 MB Laravel part	13.7 GB RSS, 201 s	4.65 GB, 177 s (.o +1.5%)
/api/ping heap growth after gc	~3.9 KB/request (main 8c95ce8)	0 (82 568 nodes before and after ~14K requests)
/api/notes	crashed on the first request (also on main)	works; heap flat
Laravel boot	Typed property Application::$appPath must not be accessed before initialization (main)	boots

/hello still grows by ~5 nodes per request. That is legitimate: with SESSION_DRIVER=array every cookieless wrk request creates a new session and ArraySessionHandler stores it.

Changes

Build memory and IR size

• -mllvm -enable-machine-outliner=never. On arm64 the MachineOutliner is a module pass, so it keeps every MachineFunction of a part alive until the end of codegen. That was the main source of 9–13 GB per clang.
• One cold raise per guard site (emitColdRaise): pick the message with select instead of N separate throw blocks.
• $o->$name on a known class dispatches through the reader table, not a strcmp chain with the full read path per name (Carbon::roundUnit was 348K IR lines).
• Runtime helpers that cannot unwind are emitted as call, not invoke.
• The cell_int_bad slow path moved out of line.

Ownership / leaks

• Release the discarded result of a builtin that mints a value (json_decode('[]');).
• An array + inside a conditional arm, and a cell + stored to a local, are owned, not borrowed.
• A closure generator owns its env in the frame (env@56, GEN_HEADER 56 → 64). This makes it safe for an invoke to release the +1 it holds for a conditional or literal callee.
• Cycle collector: an object in an untyped (cell) property is now walked as a child, and the other cell slots of a collected node are released. Before this, no cycle through an untyped property was ever collected; this is what kept Laravel's per-request Request/Route/closure graph alive.
• is_a() with an erased string subject releases the strval() result it creates.
• An owned call result used as a callee is released after the call, including a callable-typed word (classified at run time by its allocator header).
• A closure stored in a reference box is tagged as an object cell, so the box's cell drop sees it; reads strip the tag.
• (array) over an operand that mints a value passes its +1 through instead of retaining it again.

Correctness (regressions from #599)

• The init map of a fresh instance is seeded with its untyped properties, so lazy-ghost support no longer breaks ordinary objects.
• An inherited property keeps one representation across the hierarchy: once any class holds a bare cell, every class does (Model::$attributes was a cell in Model and vec[cell] in Note).

Tests

• New cases: leak_cell_union_cond_arm, leak_discarded_builtin_result, lazy_build_untyped_prop_null, leak_conditional_cell_callee, generator_closure_owns_env, gc_cycle_through_untyped_props, leak_is_a_erased_string_subject, closure_in_referenced_local_released, leak_array_cast_of_owned_call, leak_callable_call_result_callee.
• Promoted the 8 known-bug repros that now pass. Fixes Legacy "${$v}" variable-variable interpolation fails to compile with "dangling local $ read". #541, fixes Spreading an array into a variadic Closure parameter crashes (SIGSEGV) instead of passing the elements. #375, fixes count() of $a + $b over two bare array parameters answers garbage. #517, fixes A named argument after a spread into a closure value is bound by position instead of by parameter name. #463, fixes A variadic method reached through __call and a dynamic spread receives the whole argument array as one argument. #476, fixes Named arguments passed to an undefined method are not collected into __call's $arguments under their names. #477, fixes new $class with the name of a class that does not exist returns null instead of throwing Error #565, fixes A named argument after a spread into a variadic function is bound by position instead of by parameter name. #464.
• The inherited-representation fix has no micro test: the mismatch depends on inference order over a large program and did not reproduce in isolation. Laravel /api/notes is the check.

Validation

• Topic subsets green on this head, rebased on 5e4a0f72: leak, closure, callable, invoke, gen, cast, own, ref, prop, gc, lazy, is_a.
• Green before the rebase onto 5e4a0f72, not rerun since: array, class, inherit, async, fiber, str, json, tern, cell. xfail.sh before the rebase: 45 XFAIL, 0 XPASS.
• Not run yet: the full AOT suite, difftest, and the Linux gate. All three are required here: this changes the cycle collector, the generator frame layout and ownership rules.

Still open

• A closure literal in an arm of a conditional callee is never released: ($f ?? function () {...})() keeps the env and its captures alive. #590: a closure-typed conditional with a closure-literal arm is not owned.