feat(inspector): support JSC heap allocation sampling

[steipete]

OpenClaw's catalog performance consumers reach HeapProfiler.startSampling, which the in-process inspector did not implement. Add startSampling, getSamplingProfile, and stopSampling for callback and promise Sessions using the real per-VM JSC allocation sampler from the immutable OpenClaw WebKit release integrated by #124.

Preserve Node defaults, synchronous callbacks, repeated-start behavior, major/minor collection flags, worker isolation, and session cleanup. Profile retrieval forces full collection. Numeric validation uses an immutable intrinsic and truncation happens in the native binding, so replacing public numeric helpers cannot violate the engine's interval precondition. Sampling through a worker's connectToMainThread() remains unsupported. Upstream's CLI heap-profile work in oven-sh#34842 is separate from these Session commands.

Validation on Linux x64, with unmodified OpenClaw b02eab15853b6471d1869f2a2cb0f135b7aefe4d and Node 24.21.0 controls:

• Inspector suite: 78 passed, zero failures.
• Plain fork selection: 25 files, 27/27 result rows passed.
• Gateway and Codex native catalog performance consumers: each passes on the candidate and Node; the earlier baseline fails both at missing startSampling.
• The original sampler patch fails both public numeric-helper override cases; the corrected candidate and Node pass.
• Pinned formatting checks and independent scoped P2 review pass.

The committed production manifest is unchanged by this PR and selects the published engine. No runtime publication is included.

Final head c8de1bfd252a50c03286cb83d7e3a73cca6b5395 passes both native CI lanes, formatting, source lints, and built-in module typechecking. The complete standalone Linux proof used 46754a481e350a63b64ac3edd5449ef1056604ba; the final follow-up adds only the missing TypeScript declaration for the intrinsic, with unchanged runtime code. The final head also builds successfully on macOS arm64.