Merge train: #9704, #9710

[proggeramlug]

Merge train: #9704, #9710. Cherry-picked onto one branch, validated once as a tree, rebase-merged so each commit keeps its author.

#9704 — the exact-receiver inliner ignored prototype replacement (#9239). It substituted a declared method body even when the prototype had been monkey-patched at run time, so the replacement was never observed. Admission now requires a module-wide stable prototype-chain proof, and only the touched classes and their descendants lose inlining.

What makes this one sound is the direction it fails in. An unrecognized prototype holder sets opaque_prototype_access = true; the child walk runs unconditionally after the match, so the bare _ => {} means "this node isn't an access" rather than "stop descending"; walk_expr_children is an exhaustive match, so a new Expr variant breaks the build instead of silently escaping the proof; and visit_stmt enumerates its no-op variants rather than using a catch-all. Closure bodies get an explicit visit because the shared walker deliberately doesn't descend them (per the 2026-07-02 audit note in deforest/walk.rs) — that one is load-bearing, not incidental.

#9710 — buffer-backed Uint8Array misses (#9347). The intrinsic length / byteLength / byteOffset / buffer getters threw TypeError on a Uint8Array receiver, Node-API reported it as not a typed array, and preventExtensions / Reflect.set either reported stale extensibility or lost ordinary-property writes. Int32Array was already correct. Both GC-holder gates confirm its address-keyed TYPED_ARRAY_OWN_PROPS state is already classified, and the PR adds gc/tests/buffer_side_tables.rs covering prune-on-death.

Validation

64/64 lint gates; release build; perry-runtime, perry-stdlib, perry-transform (all RUST_TEST_THREADS=1), and issue_9131_prototype_method_replacement — all green.

A first gate run reported cargo clippy --workspace red; it did not reproduce. The gate's exact command with all 18 exclude args exits 0, and the warnings it printed were in perry-ext-ads / perry-ext-events, which neither PR touches. The full 64 were re-run clean rather than waiving it on one gate's say-so.

Not in this train

#9705 was pulled after audit — its borrowing _static registration spelling is unsound for plugin dylibs, which perry_plugin_unload dlcloses while the registries still borrow their rodata. Fix written and landing separately.