String resource list detach and bounded byte wipe

RE-676. Reproduce with python3 scripts/analyze_qvm_string_release.py; check with python3 scripts/test_qvm_string_release.py. The machine report retains source identity and bounded fixtures.

Complete249640–249739 follows the global30004 list and compares the requested pointer−8 header. It rewires previous/next links, updates the global head when needed, computes length with actual36038, wipes header plus length bytes and requests heap release16934 on the header. The terminating NUL lies just outside the requested wipe but is already zero; trailing canaries are preserved. A missing header returns without strlen/wipe/free calls. All backing bytes are independently checked, including partial-word wipe tails. Wipe effects are explicitly modeled and heap coalescing remains captured, so this does not establish original allocator/lifetime/double-free parity.

No original executable/full QVM/native collision/physics/rendering executes. Native responses and legal input domains are supplied or unverified where stated; full runtime/macOS/Linux Rust/Bevy/Solari gameplay remains open.