gc: js_string_concat_box is missing from POLL_CAPABLE_RUNTIME, blinding moving root-dominance arms

[proggeramlug]

Summary

The lightweight checker audit is red on current main (79d2f59ed):

$ python3 scripts/gc_root_dominance_check.py --audit-poll-reach
=== poll reach: 3791 exported symbols, 1616 with an intra-runtime call edge, 384 matched by ALLOC_RE
error: ALLOC_RE symbols that CALL a POLL_CAPABLE_RUNTIME symbol but are not in POLL_CAPABLE_RUNTIME:
  js_string_concat_box                             -> js_dynamic_string_or_number_add

js_string_concat_box gained a call to poll-capable js_dynamic_string_or_number_add in 48c5e9a43 (#7835), but the caller was not added to POLL_CAPABLE_RUNTIME.

Why this matters

The checker already classifies js_string_concat_box as a heap-value source via ALLOC_RE. Its body can now re-enter JS / reach a moving collection through js_dynamic_string_or_number_add, but a window whose only collection point is this helper classifies as MOVING: no.

That means every gated --moving-only arm drops the window, including the statepoint arm that checks the shipped lowering. This is the exact referent-with-no-name failure mode that #7616 and the --audit-poll-reach audit were added to prevent.

The workflow does run this audit, so current PR/main runs can report red, but gc-root-dominance is not a required branch-protection context (tracked separately in #7737 item 4).

Relevant source:

• js_string_concat_box delegates non-string operands
• --audit-poll-reach explains the blind spot
• The audit is wired before the expensive corpus build

Acceptance criteria

• Add js_string_concat_box to POLL_CAPABLE_RUNTIME (or remove the poll-capable call only if semantics still match perf(codegen,runtime): let a declared string pick the concat lowering #7835).
• Add a focused checker self-test for an ALLOC_RE wrapper that delegates to a poll-capable helper, so this exact edge remains covered.
• python3 scripts/gc_root_dominance_check.py --audit-poll-reach passes.
• Re-run the moving/statepoint corpora and triage any newly exposed windows; do not merely make the structural audit green if adding the symbol reveals real root-dominance findings.