Per-interpreter runtime state and a process-wide GC stop-the-world - #8517

The generation lists are process-global, so a collection reads and frees
objects owned by every interpreter. CollectStopTheWorld stopped only the
collecting interpreter, leaving other interpreters' threads free to mutate
the same object graph during the reference-subtraction, reachability and
snapshot phases.

Stop all live interpreters instead, in runtime id order, and restart them in
reverse. The global `collecting` mutex serializes collectors process-wide, so
no second collector takes these exclusions in another order; fork acquires a
single interpreter's exclusion, so the orders cannot cycle.

- runtime: add live_interpreter_states(), ordered by interpreter id.
- StopTheWorldState methods take &PyGlobalState instead of &VirtualMachine,
  so an interpreter's world can be stopped without a VM for it; update the
  call sites in frame, _thread, posix, faulthandler and capi.
- Document in gc_state() that the collector is process-wide: gc.disable(),
  thresholds, gc.garbage and gc.get_objects() observe process-wide state, and
  a per-interpreter collector additionally needs untrack_object (called from
  default_dealloc with no VM in scope) routed to the owning interpreter.

Tests: stop_the_world_parks_threads_of_another_interpreter asserts a thread
entered in one interpreter parks another interpreter's threads (it fails
without this change), plus a collect-while-another-interpreter-churns test.

Assisted-by: Claude Code:claude-opus-4-8

The registry held `rc::Weak` in a process-global `OnceLock` and covered the
resulting `!Send`/`!Sync` with an `unsafe impl` justifying it as "non-threading
builds are single-threaded". That is not this codebase's model: `static_cell!`
is thread-local without the `threading` feature precisely so each OS thread can
own its own `Context::genesis()` and `GcState`, so two threads could reach the
same `Rc` counts through the registry.

Use `static_cell!` for the registry as well, matching `gc_state()`, and drop the
`unsafe impl`. Ids are consequently unique per registry rather than per process
in non-threading builds, which is documented on `alloc_interpreter_id`.

Move the recorded main interpreter id into the registry so it follows the same
scoping instead of living in a separate global `OnceLock`.

Also make `CollectStopTheWorld::new` accumulate into a live guard: it built a
bare `Vec` and only moved it into the restarting `Drop` type after stopping
every interpreter, so an unwind partway through the loop left the already
stopped interpreters parked forever with their exclusion held.

Assisted-by: Claude Code:claude-opus-4-8

`enter_vm` decided whether to attach from `was_outermost` (an empty VM_STACK),
which held while a thread could only ever be in one interpreter. With a slot per
(thread, interpreter) pair, entering interpreter B from a thread already inside
interpreter A's section switched CURRENT_THREAD_SLOT to B's slot but attached
nothing: the thread then ran B's bytecode with B's slot DETACHED while A's slot
stayed ATTACHED. A collector stopping B force-parks the DETACHED slot and
concludes B is stopped, and then walks the object graph this thread is still
mutating.

Pair the attach/detach with the slot switch instead (≈ `_PyThreadState_Swap`):
`begin_interpreter_section` detaches the enclosing interpreter's slot, makes the
target slot current and attaches it, and `end_interpreter_section` undoes that
and re-attaches the enclosing interpreter. Both live in `set_current_vm`, which
every path making a VM current already goes through, so `enter_vm` and
`VmBootstrapGuard` no longer track outermost-ness themselves.

`nested_enter_of_subinterpreter_is_stoppable` covers this: it runs a
subinterpreter nested inside the parent's section and asserts the sub's threads
park when the sub's world is stopped. It fails with the previous
attach-at-outermost-only behavior.

Assisted-by: Claude Code:claude-opus-4-8

Interpreters share the context, so `class Foo(int)` in one of them pushes
onto the same `int.subclasses` every other one reads, and
`int.__subclasses__()` returned types no other interpreter can reach.

Record the creating interpreter on `HeapTypeExt` and filter
`__subclasses__` by it, the way `lookup_tp_subclasses` reads
`tp_subclasses` out of per-interpreter state for static builtin types.
Types built before any interpreter exists — the ones the shared context
creates, including the exception hierarchy — carry no id and stay visible
to every interpreter, which is what `_PyStaticType_InitBuiltin` produces
by registering the builtin subclass links once per interpreter.

The other walks over `subclasses` (version-tag invalidation, abc flag
propagation, mro updates, slot propagation) are left as they are: each
starts from a type being mutated, so from a heap type, whose subclasses
all live in the interpreter that created it.

`subinterpreter_subclasses_are_scoped_to_their_interpreter` covers this
and fails without the filter.

Assisted-by: Claude Code:claude-opus-5

The generation lists stay process-wide, because an object is untracked from
`default_dealloc`, where no interpreter is in scope to route to. What changes
is that a collection no longer acts on every interpreter's objects, and the gc
module no longer reports one interpreter's state to another.

`track_object` stamps the running interpreter into a new `gc_owner` word on the
object header, and a collection takes as candidates only the objects carrying
its own tag plus the ones carrying none. `gc_owner` fits in the padding the
header's alignment already forces, so objects do not grow; an assertion on the
header size keeps it that way.

Objects allocated with no interpreter running — everything the shared context
builds — carry no owner and stay candidates for every interpreter, which is
where they were before. Objects that outlive the interpreter that tracked them
are adopted the same way by the next full collection, rather than being left to
a collector that will never come.

`enabled`, the thresholds, the debug flags, the statistics, `gc.garbage` and
`gc.callbacks` move onto `PyGlobalState` — the last two off the shared
`Context` — so `gc.disable()`, `gc.set_threshold()`, `gc.get_stats()`,
`gc.get_objects()` and `gc.garbage` describe the interpreter that asks. The
occupancy counts behind `gc.get_count()` and `gc.get_freeze_count()` stay
process-wide: they measure how full the shared lists are. Their decrements are
saturating now, since a collection zeroes the generations it emptied while
another interpreter's objects are still sitting in them.

Stop-the-world still stops every interpreter. Unowned objects are candidates
and any interpreter can incref one, so the refcounts a collection reads are
only stable while all of them are parked.

This also fixes a deadlock it exposed: `CollectStopTheWorld` dropped its
references to the stopped interpreters while the collection still held the
generation read locks, so releasing the last reference to one — which frees its
objects, and so untracks them — waited for a write lock behind that read lock.
The references are now held until the guard itself drops.

`collections_only_reach_the_collecting_interpreter` and
`get_objects_only_reports_the_calling_interpreter` cover this and both fail
without the owner check.

Assisted-by: Claude Code:claude-opus-5

`_queue.Semaphore` holds its mutex across the `allow_threads` condvar wait,
and `join_internal` holds a thread handle's completion mutex the same way.
Stop-the-world can stop a thread while it holds either one. The remaining
acquisitions ran attached, so a thread blocking on such a mutex had no
safepoint left to reach: the stop never completed, and the holder was never
resumed to release it.

Route those acquisitions through helpers that detach first. The fork-child
reinit paths keep their direct locks.

Assisted-by: Claude

`TextIOWrapper.__repr__` took `data` directly while every other method takes it
through `lock_opt`, which detaches. `Overlapped` holds `inner` across the
`allow_threads` in `GetOverlappedResult`, and all four of its takes were direct.

A thread stopped by stop-the-world can be holding either mutex, so taking one
while attached left the blocked thread with no safepoint to reach.

Assisted-by: Claude