Add allocation domains and Rust destruction on poisoning

The current interpreters reclaim known roots recursively. Opaque native destructor adapters consume their target before invoking Rust destruction, and Rust `Buffer::drop` discards any remaining boxed slot payloads. These mechanisms close specific leaks but do not establish complete ownership of a runtime generation's allocations or external resources.

A proper allocation domain system must be implemented so that no memory is leaked when an execution domain is poisoned, while never double-freeing any resource.

Start by tracing the current recursive root reclamation, opaque native destructor adapters, and Rust Buffer::drop behavior described in the issue. Define the ownership boundaries for a runtime generation and verify that poisoning reclaims every allocation and external resource exactly once, without double-freeing.

Written by the indexing model from the issue text.