[nahime0]

Fix the PHP-visible regressions and remaining audit findings from #2090.

• Preserve mb_str_pad() and mb_convert_case() argument errors, source evaluation order and correct padding error names. Limit native multibyte padding to integer length/mode operands, preserving TypeErrors and accepted weak numeric-string coercions through the bridge. Treat multibyte trim masks as literal characters and remove the compiler debug print.
• Require contract-proven canonical scalar arguments before native mbstring shortcuts bypass shared preparation. Preserve Stringable callbacks, weak conversions and strict TypeErrors, retain caller strictness when selecting length/count/cast helpers, and keep nullable setting getters from becoming setters.
• Keep MIME and regex literals dependent on live request encoding. Guard regex count/length byte scans with encoding, syntax/options, resource limits and ASCII checks. Release a failed split result before raising count()'s TypeError.
• Keep iconv's runtime decoder for interior Base64 padding. Preserve the original explode() diagnostic when count fusion cannot prove scalar coercion.
• Remove four EIR folds that erase caller-visible progressive regex mutations, assume a default iconv encoding, or drop mb_convert_variables() updates to illegal_chars. Progressive native searches, including mb_ereg_search_pos() and mb_ereg_search_regs(), honor live configured limits and deliver diagnostics through the ordinary callback bridge.
• Retain dense dominator bitsets through validation, avoiding repeated hash-set expansion. Preserve every validation gate and test dominance across a bitset word boundary.

Validation:

• Focused codegen tests cover the semantic regressions and bounded mixed-counter cases. New semantic fixtures run with IR optimization enabled and disabled, with heap checks and PHP 8.5.12 reference outputs.
• The progressive result-array limit regression and existing regex-observer case pass with both IR modes and heap checks. The original low-limit reproducer now matches PHP, including one warning per call, false results, unchanged cursor and cleared captures.
• Padding type validation, padding error-name and length-validation regressions pass in both IR modes with heap checks. Nonnumeric mode/length errors, validation without actual padding, and valid numeric-string calls match PHP.
• Stringable, integer/strict argument preparation and weak/strict observer regressions match PHP in both IR modes with clean heap checks. Original native controls cover literal versus dynamic case conversion, null setting getters and strict length/cast/count observations.
• Fifteen validator/storage unit tests pass. Focused AST, mbstring ABI-state and emitter guards also pass, including all five supported targets.
• Release build, builtin documentation regeneration/audits, target architecture, assembly-comment and diff checks pass. Generated builtin documentation has no drift.
• Controlled comparisons cover 16 unchanged fixtures/30 native variants against both the audit base and immediate pre-merge main, with raw samples, exact source revisions, archive fingerprints and semantic reproducers in the measurement report.

The local runtime comparison retains 3.38x array_sum, 3.60x sum_loop and 1.25x indexed-array speedups versus immediate pre-merge main. Dense validation reduces the opaque-eval debug compile median from 37.0s to 32.5s. The recorded release compiler comparison for that probe still costs +3.3% with IR optimization on and +11.8% with it off; the report preserves this remaining cost and measurement variation. Four selected benchmark assembly files are identical before/after the validator change.

The pre-existing Stringable limitation in explode() remains: its count-fusion fix restores the original diagnostic. Full supported-target execution coverage runs in CI, with ci:macos enabled.