Merge upstream dev3 (261 commits): #1271 audit fixes, init/subproc restructure

[Jarred-Sumner]

Merges upstream dev3 (261 commits, through 6def7be) into bun-dev3-v2.

What comes in

Area
microsoft#1271 audit fixes	Purge bits skipped when the minimal purge range is a non-power-of-two number of slices (not the case in our configuration — measured as neutral); use-after-free of meta stats in sub-processes; thread-locals release order at destroy; tld leak on theap alloc failure; heap merge subproc; singleton-page init failure path (matches the fix this fork carried); NUMA detection on Linux; random key zeroed after use
Restructure	init.c split into subproc.c / prim-tls.c; the static main heap and tld become meta-data allocations; theap teardown redesigned around a detach protocol
New API	Constant-size inline malloc/free entry points (not used by Bun yet)

Ported onto the new structure

Fork feature	Change
fork() handlers	Moved to subproc.c beside the registry they walk; cover every sub-process and the new meta lock; every registered tld is re-initialized in the child
Profiling	Third page-flag bit (thread-id sentinels shift with it); the sample check now runs at both exits of the generic path, which upstream split
Hole sweep	State packed into 64 bits since page->used is now 32-bit (test updated)
tld registry, per-theap prof init, atfork registration, exit hooks, exit-time opt-out	Re-homed
_mi_theap_can_touch	Accepts upstream's detached theaps
Zone enumerator	Uses the page's start-offset field
Dropped	Our try-acquire _mi_theap_free and the teardown re-collect — upstream's detach protocol covers both
Kept	Thread-local slot zeroing (upstream's meta rezalloc still copies usable_size bytes of slack — to be reported), the Linux resident-size reading; upstream's version taken where it now covers the same bug (chunkmap, page free)
Public API	Upstream moved mi_malloc_size / mi_malloc_usable_size into alloc-override.c, so MI_OVERRIDE=OFF builds (Bun's ASAN lanes) lost two exported functions — restored for that configuration (to be reported)
Build as C++	Upstream's new try in the new-handler path guarded like the throw above it (to be reported)

_mi_message was silently dropped by a clean merge of options.c; afterwards every fork-added symbol (155) was checked against the merged tree.

Validation

This repo	Debug: 20/20. Release: 19/19
Bun	See the measurements below; the startup-snapshot suite is green against this content

Bun measurements (macOS arm64, release builds of the same Bun commit; the pin is the only difference; paired rounds; memory = Bun.unsafe.memoryFootprint / phys_footprint, not RSS)

	Old pin → this
Retained by size class, 1-in-64 survivors (purge machinery)	Identical (256 B ≈ 6 MB both; 1 K–16 K ≈ 0 both)
Bare startup footprint	6.54 → 6.75 MB (+0.2 MB, 5/5 pairs; the meta-allocated per-thread structures)
Churn workload peak / final	Peak: no consistent difference over 9 pairs. Final: consistently a little lower
express (bombardier, 300k requests) — settled footprint, read after a forced full GC	43.4 → 43.2 MB avg over 5 pairs (equal; an earlier unforced reading looked ~7 MB lower but that was JSC heap timing at the moment load stopped, not the allocator)
express peak footprint	No consistent direction
express throughput	89.5k → 90.1k rps (parity)
Bun's startup-snapshot suite (with #16)	45/45 after two interactions were fixed: the build-marker presence check (in #16) and a snapshot-writer assumption that every owned mapping has something resident (fixed in Bun — this allocator's page-map tables can be entirely untouched at build time)