bun_ptr: only a BackRef minted from a ThisPtr can hand a ThisPtr back
What
Closes a hole a reviewer spotted on #40190 (present on main since #40055): BackRef<T, Mut>::this_ptr() was callable on any BackRef::new_mut(&mut t), so safe code could mint a ThisPtr to a stack value and then RefPtr::from_this(..).deref() it into the destructor.
bun_ptr::Root is a third provenance marker meaning "this back-reference is the root pointer of a live heap allocation": it is built From<ThisPtr<T>> (or unsafe from_root for a leaked Box, used by queue_microtask_boxed) and is the only BackRef flavour with this_ptr(). Mut keeps new_mut/get_mut/as_ptr and loses this_ptr. Every existing user (CronJob::self_ref, the websocket tunnel's UpgradeClientRef/connected_websocket, InitialDataTask, the HTMLBundle route maps in server_body/DevServer) was already minted from a ThisPtr and just changes its type parameter. No runtime behaviour change.
The open unsafe-removal PRs (#40139, #40187, #40190) will pick this up on rebase.
Testing
cargo clippy -p bun_ptr -p bun_jsc -p bun_http_jsc -p bun_runtime -D warnings clean; type-level change only.