feat(runtime): sendable actor heaps and the explicit execution context

[niklas-heer]

Step 1 of five toward parallel actor execution, specified in
docs/superpowers/specs/2026-09-15-sendable-actor-heaps-design.md and planned in
docs/superpowers/plans/2026-09-15-sendable-actor-heaps.md.

Why

The scheduler executes FIFO continuation callbacks on one thread, and the BEAM
comparison records actor throughput, scheduler fairness and fault recovery as
unmeasured. Reaching parallelism means changing heap ownership, which is the
hardest thing in the runtime to change once more code depends on it.

This step produces no parallelism. It should be judged on whether it makes step 2
possible without a second ownership rewrite.

What changed

Heap ownership moves out of thread_local! { static STORE } into an explicit
Domain. The thread-local keeps only a cursor to the domain executing on this
thread, installed by an Activation guard that restores the previous value on
drop. Domain is Send; Root and Scope stay thread-bound.

Foreign entry point signatures and the compiler's symbol contract are unchanged.
The 257 no_mangle entry points reach the store through roughly twelve functions
in memory.rs, so nothing outside memory/heaps.rs changed shape and no codegen
work was required.

Commits 1-5 are a mechanical extraction that changes no ownership. Commit 6 is the
only ownership change. Reviewing them in order is much easier than reviewing the
diff as a whole.

Evidence

• The seeded actor scenario reproduces trace hash 01a55a0046de5614 before and
  after, with identical 48,334 callbacks, 1,226 delivered, 3,774 timeouts, 2,501
  restarts and 9,977 churn actors, and zero cleanup residue. Record and replay
  round-trips.
• Full macOS ARM64 gate: 316 native-output fixtures, 20 examples, 63 dynamic
  compatibility programs, 295 atomic rejections, 64+192+231 fuzz cases.
• Runtime suite grows 99 to 107 tests, including a cross-heap edge oracle whose
  negative case fabricates an edge the collector would never build, so the oracle
  is demonstrably able to fail.
• ThreadSanitizer runs the instrumented suite clean: 107 tests, zero race reports,
  2,389 s on one Apple M4.

Measured cost

The allocation-heavy immutable model (workloads.mr model 100000) regresses from
a 59.03 ms to a 59.96 ms median, +1.58%, over 25 interleaved samples per build.
The allocation-light scalar control moves +0.09%, which locates the cost in the
allocation path: the un-activated default path now takes two thread-local accesses
where it took one. libmorrow_runtime.a grows 13,494,480 to 13,506,976 bytes.

The regression is recorded rather than rounded off. Step 2 runs every actor under
an activated domain, making the cursor path hot instead of the default path;
whether that recovers the difference is a measurement for that step.

Worth reviewing closely

1. The Busy aliasing guard. Replacing RefCell with a raw pointer would
   silently drop the aliasing check it enforced. Root::drop can run from a
   finalizer during collection, re-entering the cursor while collect_active
   holds the domain. That was a panic; without the guard it becomes undefined
   behaviour.
2. collect_active scans every actor heap in the domain when the invocation
   heap is active. The design document missed this. It is a collection-time
   coupling, and it means a scheduler's domain must own its actor heaps rather
   than lend them out, which constrains step 2.
3. Domain: Send is asserted at compile time; Root/Scope staying !Send is
   not. Rust cannot express a negative auto-trait bound without fragile tricks,
   so that half rests on the PhantomData<Rc<()>> markers.

Note on the new CI job

The ThreadSanitizer job takes about 40 minutes and finds nothing while execution
is single threaded. It is added now so the harness and any suppressions exist
before parallel schedulers make it load bearing. Restricting it to pushes on
main rather than every pull request is a reasonable call.

🤖 Generated with Claude Code