Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@crates/vm/src/builtins/function.rs`:
- Around line 1179-1222: PyBoundMethod currently uses the auto-derived Traverse
but lacks a manual Traverse::clear implementation, so freelisted PyBoundMethod
objects retain strong refs to their object and function fields and block GC;
implement a manual impl Traverse for PyBoundMethod that provides a clear(&self)
(or clear(&mut self) following the crate pattern) which detaches/releases the
strong references (set object and function fields to
PyObjectRef::none()/ptr::null or equivalent detach method used by
PyFunction/PyTuple), then ensure freelist_push stores only cleared objects so
freelisted PyBoundMethod will not keep references alive (update the impl for
PyPayload::clear/Traverse for PyBoundMethod to match the existing pattern used
by PyFunction, PyTuple, PyList, PyDict).

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@crates/vm/src/object/core.rs`:
- Around line 852-861: The current teardown loop in self.items.drain(..)
directly deallocates the raw PyInner<T> buffer (Layout::new::<PyInner<T>>())
which skips payload destructors and allows unbounded byte/heap leaks for types
with large owned payloads; change it so teardown only raw-deallocates when it is
provably safe and otherwise drops or scrubs payloads: add a marker trait (e.g.,
SafeToTearDown) or a per-type flag and, inside the loop over self.items, for
items where T: SafeToTearDown use ptr::drop_in_place or ptr::read to run
destructor on PyInner<T> (dropping owned fields), and only fall back to
alloc::alloc::dealloc for types not safe to drop; alternatively enforce freelist
policy per type by limiting capacity for non-SafeToTearDown types before
teardown. Ensure references to self.items.drain(..), PyInner<T>, and
Layout::new::<PyInner<T>>() are updated accordingly.

---

Outside diff comments:
In `@crates/vm/src/object/core.rs`:
- Around line 825-830: Update the FreeList doc comment to reflect the current
Drop behavior: replace the statement that Drop "converts each raw pointer back
into Box<PyInner<T>> for proper deallocation" with a precise description that
Drop performs raw deallocation of the stored pointers without running their Rust
destructors (i.e., it calls dealloc on the raw allocation), mention that this is
unsafe and intentionally avoids destructor execution, and reference the
FreeList<T> type and its Drop implementation so readers understand the semantic
change.

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@crates/vm/src/object/core.rs`:
- Around line 852-861: The teardown loop in self.items.drain(..) unsafely
deallocates PyInner<T> bytes without running payload Drop, so the claimed bound
by MAX_FREELIST is incorrect because payloads may own unbounded heap memory;
change the teardown to detect types whose payloads may allocate (or implement
Drop) and for those either call their destructor (run Drop) or use a safe
per-type policy that moves items into a safe drop path (e.g., call a provided
safe_free/drop_fn for the type) instead of raw dealloc; locate and modify the
loop that deallocates with alloc::alloc::dealloc(ptr as *mut u8,
Layout::new::<PyInner<T>>()) and the PyInner<T> handling to branch on a
trait/flag (e.g., implements Drop/HasHeapPayload) or whitelist-only raw dealloc
for truly fixed-size types to avoid leaking unbounded heap bytes.