internal/primordials: Node.js parity, generated and engine-backed - #35567

The "pollution planted before any lazy holder exists" test's precondition ("Nothing has touched Map/Set/Date/Math/JSON/... yet in this process") is false for Map/Set/WeakMap/WeakSet/JSON/Reflect: the shared prelude reads `JSON.stringify` / `Reflect.ownKeys` / `Reflect.apply` directly (lines 21, 30-31), and `require("bun:internal-for-testing")` eagerly evaluates `exposedInternals` → `internal/webstreams_adapters` → `internal/primordials`, whose module body runs `makeSafe(Map/Set/WeakMap/WeakSet, 

`primordials.refs()` is now dead code — its only caller (`test/js/bun/util/primordials.test.ts` at 8ea828c8, line 49) was removed when e4b48731 rewrote the test file to use `primordials.audit()` exclusively, and `audit()` already returns `.value` for every primordial so `refs()` is a strict subset with no remaining purpose. Per REVIEW.md ("Delete dead code in the same PR that makes it dead … helpers whose last caller you rewired"), delete the `refs()` method.

The `AsyncIteratorPrototype` holder factory is one prototype hop short: `getProto(protoOf(() => (async function* () {})()))` yields **%AsyncGeneratorPrototype%** (owns `next`/`return`/`throw`), not **%AsyncIteratorPrototype%** (owns `Symbol.asyncIterator`) — async generators have an extra per-function `.prototype` link that the sync-iterator factories don't. `liveValue` still finds `Symbol.asyncIterator` via inheritance so the identity checks pass, but every tampering test defines/deletes on the

Step 3's "structural attacks" are dead code: `Object.setPrototypeOf`/`seal`/`freeze` are themselves `ObjectConstructor` primordials, so step 2 has already deleted them from `Object` and planted `poison` on `Function.prototype` at those keys — by the time step 3 runs, `Object.setPrototypeOf(holder, ...)` resolves to `poison`, returns the string `"poisoned"`, and mutates nothing (the `try/catch` hides the no-op). Capture `setPrototypeOf`/`seal`/`freeze` in the prelude alongside `defineProperty` an