feat(node:zlib): Transform-stream objects + Brotli fns (#1843)

[proggeramlug]

Summary

Implements the node:zlib Transform-stream interface (cluster 1 of #1843, the highest-leverage gap) plus Brotli functions (cluster 2) and fixes two latent handle-dereference segfaults surfaced along the way.

node:zlib is routed to the perry-ext-zlib crate via well_known_bindings.toml (#466), so the work lands there, wired into perry-stdlib's event loop through a new external-zlib-pump feature (mirroring external-net-pump). A bundled equivalent lives in perry-stdlib's compression feature for the no-flip path.

What now works

zlib.createGzip() / createGunzip() / createDeflate() / createInflate() / createDeflateRaw() / createInflateRaw() / createUnzip() / createBrotliCompress() / createBrotliDecompress() return real stream objects supporting:

• .write(chunk) / .end([chunk]) (Buffer or string chunks)
• .on('data' | 'end' | 'error' | 'finish' | 'close', cb) / .once / .addListener
• .pipe(dest) (forwards data→dest.write, end→dest.end, returns dest for chaining)
• .flush() / .close() / .destroy()

Plus one-shot zlib.brotliCompressSync / brotliDecompressSync / brotliCompress / brotliDecompress (the brotli crate was already a compression dep).

Compression is synchronous, so input is buffered across .write() and the codec runs once on .end(); the resulting data/end events are deferred onto a queue drained by the main-thread pump, so listeners registered after .write() still fire and .pipe() can forward chunks.

End-to-end output is byte-for-byte identical to node --experimental-strip-types for gzip/deflate/brotli stream round-trips, .pipe() chains, and zlib.constants.Z_*.

Runtime segfault fixes (general)

Two is_class_object_ptr / js_value_typeof low-address guards only rejected the tiny net/fastify id space (< 0x1008 / > 0x10000). A native-module registry handle in the mid range (zlib uses a 0x60000 stream base to stay clear of those id spaces) sailed past them and segfaulted dereferencing [handle - 8] / [handle + 12]. Both now reject anything < 0x100000 — the same handle/real-pointer boundary js_native_call_method already uses (real heap objects always live well above it). This also raises every handle subsystem's latent id ceiling from 0x1008 to 0x100000, and makes typeof aStreamHandle === "object".

Buffer-aware one-shot input

gzipSync/gunzipSync/deflateSync/inflateSync/brotli*Sync read their argument through a buffer-aware reader, so a real Buffer/Uint8Array (e.g. gunzipSync(Buffer.concat(chunks)), gunzipSync(fs.readFileSync(...))) is read via its BufferHeader rather than misread as a StringHeader.

Out of scope / follow-ups

• .flush([cb]) is a no-op (the buffer-until-end model has nothing to flush mid-stream); incremental-flush tests like test-zlib-flush-drain-longblock.js are not addressed here.
• Per-write incremental data emission (output currently emits on .end()).

Closes #1843 (cluster 1 + cluster 2 + cluster 3 Z_* constants).