gc: fix assert(!freedall) when gc_scrub marks past lim_newpages (#61640)

`gc_scrub_range` (active under `WITH_GC_DEBUG_ENV`) conservatively marks
any
pool object it finds on a task stack by setting `pg->has_marked = 1` and
`tag->bits.gc = GC_MARKED`. It does not account for the pool's
bump-pointer
allocation frontier (`pool->newpages`): slots at or beyond this boundary
are
unconditionally treated as garbage by `gc_sweep_page` regardless of
their GC
bits (the `(char*)v >= lim_newpages` check). When every slot on such a
page
falls past the frontier, `freedall` stays 1 and `assert(!freedall)`
fires.

The mismatch was introduced by PR #50137 (June 2023), which switched the
pool
allocator to a bump-pointer scheme and added the `lim_newpages` guard in
sweep, without updating `gc_scrub_range` to match.

Fix: relax the assertion to permit `freedall=1` when `lim_newpages` is
before
the end of the page (i.e., this is the currently-active bump-pointer
page).
That is precisely the case where `gc_scrub` can set `has_marked=1` while
the
sweep legitimately finds no live objects.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>