ffi: don't free caller-owned memory in toBuffer without a finalizer - #36521

This test invokes `cc()` (TinyCC) in-process without an `isASAN` guard. Every other in-process `cc()` invocation in the repo — including the trivial `add(a,b)` case and the "GC liveness of compiled symbols" case, which is the closest analogue to this test — is wrapped in `skipIf(isASAN)` with the comment "TinyCC's setjmp/longjmp error handling conflicts with ASan" (see `test/js/bun/ffi/cc.test.ts:22,231,390,459,572,621`). Consider adding `it.skipIf(isASAN)(…)` here, or reusing the compiled fixtu

The three `runsClean` subprocess tests destructure only `{ stdout, exitCode }` (dropping the `stderr` that `runsClean` reads and returns) and assert with `toContain("survived-gc")`. REVIEW.md's subprocess-test rule and every sibling subprocess test in this file use the combined-object form — `expect({ stdout, stderr, exitCode }).toEqual({ stdout: "survived-gc\n", stderr: "", exitCode: 0 })` — which is available here since `bunEnv` silences debug logs, and gives a much better failure message. App