Retain trace-proxy callback (fix Hermes use-after-free)

[beaucollins]

Summary

JavaScriptRuntimeTraceProxyCallable stored the wrapped callback as a bare, non-owning JSValue. Under the Hermes engine the callback's pooled ManagedHermesValue could be released to zero and its slot recycled while the proxy still referenced it, so a later invocation hit a dangling handle and threw "Value is not a function".

Fix

Hold the callback as an owning JSValueRef via JSValueRef::makeRetained, retained for the proxy's lifetime and released in the destructor. This matches how the rest of JavaScriptRuntime.cpp retains values kept across native calls (e.g. JSValueRef::makeRetained, JSValueRefHolder::makeRetainedCallback).

Notes

Only reproduces under Hermes (QuickJS's value model doesn't dangle a bare handle) and only when the tracing layer wraps a callback in a trace proxy. Verified with a Hermes build: crash gone across repeated launches.

[github-actions]

📊 PR Size: size/XS

Total changes: 6 lines (1 files)

Top files changed:

• valdi/src/valdi/runtime/JavaScript/JavaScriptRuntime.cpp: +3 -3

_{Size calculated as additions + deletions. Labels: XS (<10), S (<50), M (<250), L (<1000), XL (1000+)}

[github-actions]

⚠️ Bazel & CI Test Results

Test Suite	Result
valdi_web Integration Test	✅ success
Snapshot Tests	✅ success
macOS: C++ & Platform Tests	✅ success
Linux: Registry Validation	❌ cancelled
Valdi Smoke Tests	✅ success
Linux: C++ Tests	❌ cancelled
Linux: Build Compiler	✅ success
Linux: Build & Export	❌ cancelled
API Surface Check	✅ success
Linux: Module Tests	✅ success
Linux: Hotreload Smoke	✅ success

Some tests failed. Please check the workflow logs for details.

🚀 Bazel remote cache is now enabled - future builds will be faster!

_{Workflow: Valdi CI}