Implement HandleSet overflow via tagged heap chunks

[TriedAngle]

Motivation

• Prevent panics and data loss when a HandleSet exceeds its inline capacity by supporting overflow storage allocated on the heap.
• Follow the requested approach of leaking boxed overflow chunks and using a pointer tag to mark heap-owned links so overflow memory can be identified and reclaimed on drop.

Description

• Added an OverflowChunk struct and pointer-tag helpers (is_heap_tagged, tag_heap_ptr, untag_heap_ptr) and use the LSB tag convention to mark heap pointers.
• Extended HandleSet with overflow_head and push_overflow_slot so pin_value spills into chained overflow chunks once the inline HANDLESET_CAPACITY (20) is exhausted.
• Updated visit_roots to traverse inline slots and overflow chunks so GC/root rewrites update overflow handles, and added drop_overflow_chain to reclaim boxed chunks via Box::from_raw during Drop.
• Wired the new handles module into the VM by adding handle_roots_head and new_handleset() to VMProxy, initializing handle_roots_head in the bootstrap path, and added vm/HANDLESET_SKETCH.md documentation.

Testing

• Ran cargo test -p vm handles_are_ and the handle-related tests passed.
• Ran cargo test -p vm handles::tests:: -- --nocapture and all three handle tests (including the new overflow regression) passed.
• Re-ran the known unrelated interpreter test cargo test -p vm interpreter::tests::proxy_generic_field_access_uses_ctype_layout -- --nocapture and it still fails at the same site, confirming the failure is independent of these changes.

---

Codex Task