fix(train): reconcile #9917's unified test-site record with #9970's gating

#9917 collapses the three RegExp.prototype.test proof slots into one
CanonicalTestSite behind a single HotKey, but was written before #9970
gated that surface for the no-default-features product build. Merged so
both hold: the unified record, carrying #9970's cfg on the struct, its
impl, the thread_local and TEST_ACCESSOR_KEY_BIT.

Consequences reconciled:

- object_static_prototype_known_non_meta is #9917's, and its only caller
  is regex-engine gated, so it is dead in a product build. Same gate.
- The three _SLOT holder entries added for #9893 are stale: the statics
  no longer exist. Deleted, and a duplicate TEST_WALKS entry removed. The
  new REGEXP_PROTOTYPE_TEST_SITE needs no entry — the walk reaches it
  through scan_canonical_test_site_roots_mut, which
  scan_object_cache_roots_mut calls and reg_scanner! registers.
- segments_view's cursor-number store carried GC_STORE_AUDIT(NUMBER),
  which is not an accepted class, so the marker never satisfied the gate.
  POINTER_FREE is the class that states what the comment argues.

Author: Ralph Küpper

crates/perry-runtime/src/intl/segments_view.rs

@@ -139,7 +139,7 @@ impl CursorFields {
     #[inline(always)]
     unsafe fn set_number(self, index: u32, value: usize) {
         debug_assert!((F_BYTE_START..=F_UTF16_LEN).contains(&index));
-        // GC_STORE_AUDIT(NUMBER): `JSValue::number` cannot carry a heap edge;
+        // GC_STORE_AUDIT(POINTER_FREE): `JSValue::number` cannot carry a heap edge;
         // `cursor_position_fields_are_never_pointer_typed` pins the invariant
         // across every product writer.
         self.0

crates/perry-runtime/src/object/prototype_chain.rs

@@ -339,6 +339,10 @@ pub fn object_static_prototype(obj_ptr: usize) -> Option<u64> {
 /// [`object_static_prototype`] remains the entry for unclassified receivers
 /// and still checks object-owned metadata before consulting this registry.
 #[inline]
+// #9917 added this for the recorded canonical-test-site proof, whose only
+// caller is regex-engine gated; without the feature it is dead in a product
+// build. Same gate as the rest of that surface (#9970).
+#[cfg(any(test, feature = "regex-engine"))]
 pub(crate) fn object_static_prototype_known_non_meta(obj_ptr: usize) -> Option<u64> {
     if !OBJECT_PROTOTYPES_NONEMPTY.load(Ordering::Acquire) {
         return None;

scripts/gc_runtime_root_holders.json

@@ -650,32 +650,6 @@
       "verdict": "not_a_gc_pointer",
       "why": "Megamorphic property-read stub cache, the read twin of WRITE_STUB: 2-way ways of (shape_token, key_bits, slot) plain u64s. The token is a shape id and the slot an index; key_bits are content-derived by construction, because read_stub_key_bits returns short_ascii_sso_bits(key) \u2014 the key's characters packed inline \u2014 and yields None for any key that would otherwise be stored under a pointer. No way holds a heap address, so nothing here keeps an object alive, and a stale entry cannot hit: receiver_shape_token returns None for a receiver with no live shape, and the token identifies the exact key set and order, so a shape change yields a different token."
     },
-    {
-      "file": "crates/perry-runtime/src/object/regex_proto_thunks.rs",
-      "name": "REGEXP_PROTOTYPE_PTR_SLOT",
-      "verdict": "covered_elsewhere",
-      "why": "#9893: the realm's `RegExp.prototype` address, recorded so the view mode's canonicality proof is three loads instead of a by-name walk. It IS a root and it IS scanned: `object::scan_object_cache_roots_mut` (registered via `reg_scanner!` in gc/mod.rs) visits it with `visit_atomic_i64_slot` beside the iterator-prototype towers, which marks it and rewrites it when the collector moves the prototype. The walk does not reach it because access goes through the `RealmAtomicI64` wrapper's `with_slot`, not a direct static read.",
-      "scanner": "object::scan_object_cache_roots_mut (crates/perry-runtime/src/object/mod.rs), registered by reg_scanner! in crates/perry-runtime/src/gc/mod.rs"
-    },
-    {
-      "file": "crates/perry-runtime/src/object/regex_proto_thunks.rs",
-      "name": "REGEXP_PROTOTYPE_TEST_CLOSURE_SLOT",
-      "verdict": "covered_elsewhere",
-      "why": "#9893: the canonical `RegExp.prototype.test` closure, NaN-BOXED rather than a bare address, and visited as such \u2014 `scan_object_cache_roots_mut` uses `visit_atomic_nanbox_u64_slot` so the collector rewrites the pointer inside the word. Same wrapper indirection as `REGEXP_PROTOTYPE_PTR_SLOT` above.",
-      "scanner": "object::scan_object_cache_roots_mut (crates/perry-runtime/src/object/mod.rs), registered by reg_scanner! in crates/perry-runtime/src/gc/mod.rs"
-    },
-    {
-      "file": "crates/perry-runtime/src/object/regex_proto_thunks.rs",
-      "name": "REGEXP_PROTOTYPE_TEST_INDEX_SLOT",
-      "verdict": "not_a_gc_pointer",
-      "why": "#9893: the field INDEX `test` occupies on the prototype \u2014 a `u32` ordinal, not an address, sentinel `u32::MAX`. Nothing for the collector to mark or rewrite."
-    },
-    {
-      "file": "crates/perry-runtime/src/object/regex_proto_thunks.rs",
-      "name": "REGEXP_PROTOTYPE_TEST_WALKS",
-      "verdict": "not_a_gc_pointer",
-      "why": "#9893: how many by-name canonicality walks this process has done \u2014 a plain `u64` count whose whole purpose is to read 1 per realm and thereby prove the fast path is the path being taken. A NUMBER, never an address."
-    },
     {
       "file": "crates/perry-runtime/src/object/shapes.rs",
       "name": "SHAPE_YOUNG_LOG_SUPPRESSED",