fix(jsc): correct ARM64 memory addition and qualify native tiers

[steipete]

ARM64 register-to-memory add64 currently overwrites its source register with twice the old memory value and stores the old value unchanged. ARM64Assembler::add takes its destination first; put the loaded temporary first so the helper implements *dest += src and preserves src.

The testmasm regression checks 169 operand pairs, 64-bit wraparound, source preservation, and adjacent memory. Native macOS ARM64 fails before the change with expected memory 1 versus actual 0, passes after, and passes all 466 assembler tests. Local qualification also passes 1,778 JSC stress configurations, 1,639 module configurations, testFFI, and five execution modes each for accounting and sampling. Native ARM64 CI adds the JSC regression selection, modules, and explicit interpreter/baseline/DFG/FTL/concurrent-GC accounting and sampling checks. Windows ARM64 publication additionally requires five accounting modes from its exact archive.

The ARM64 add/sub/and/or memory helpers and xor64 counterpart were audited with no sibling inversion found. The pinned upstream production register-to-memory add64 callers and Air memory forms are x86-64-only; the downstream DFG typed-array accounting path exposes the latent ARM64 bug. This corrects fast typed-array accounting; the separate Blob/Response lifetime issue is outside this change.

The ten-archive matrix, Windows ARM64 lane, immutable-release controls and upstream build recipes are retained. Includes the changelog and release-note entry for the corrected successor.

The qualification fixture isolates its hot busy loop in a small function so compiling the large surrounding fixture does not distort external-memory comparisons between samples. A controlled parent workload reproduced 30/30 failures before and 30/30 passes after the extraction; the 64 KiB bound, assertions, deadlines and JIT settings are preserved. Runtime code is unaffected by this test correction.