Prototype fix for emberjs#19344: single native listener per event (invoker pattern)

[johanrd]

Prototype for emberjs#19344, stacked on the failing-test branch (emberjs#21530).

All {{on}} handlers for the same (element, event, capture/passive bucket) share one native listener dispatching to a snapshot of the handler list — sibling handlers run in a single callback frame, so a render flush scheduled by one handler cannot interleave at a microtask checkpoint and tear down the rest (Vue's invoker architecture). once is per-handler; counters track logical registration.

Scope: covers the reported same-element case. A cross-element variant exists (a handler's flush destroying an ancestor's {{on}} before the event bubbles up to it); fixing that requires deferring teardown past the dispatch — i.e. deciding whether handlers may fire after their component is destroyed — which needs maintainer input and is deliberately not attempted here.

Precedent — every mainstream framework funnels its handlers through a single native callback per dispatch; the surfaces that don't are exactly where this bug class lives:

	architecture	source
React	one native listener per event at the root, synthesized propagation, post-dispatch flush	DOMPluginEventSystem.js#L432-L435
Vue 3	per-element invoker (el[veiKey]), handler swaps mutate invoker.value, stale-event guard via e._vts <= invoker.attached	events.ts#L43-L61, #L112-L116
Solid	document delegation, handlers as node[$$event] props	client.js#L90-L96
Svelte 5	root delegation — and the same bug class, open, at the native/delegated boundary: sveltejs/svelte#18070	events.js#L173-L177
Angular	per-listener change detection by default; opt-in rAF event coalescing exists precisely for multi-handler events	ng_zone.ts#L310-L328