fix(runtime): built-ins/Array sort + mutation + species test262 parity

[proggeramlug]

Summary

Closes the built-ins/Array mutation-method tail: 729 → 821 of 823 (+92) across the 12 swept dirs (sort splice concat filter some map flat flatMap copyWithin fill toSorted toSpliced), judged against the node v26 oracle. The two remaining failures are out-of-scope tails (bare Array[1] global-ident lowering gap; sort.call(Symbol()) needs Symbol/BigInt wrapper objects).

Zero-regression validation

• Shard 0/12 of built-ins + language (2645 judged) vs an origin/main baseline build: 0 new failures, +252 fixed as collateral (85.2% → 94.7% on the shard) — the ===-correctness, in-operator, and delete fixes help well beyond Array.
• cargo test -p perry-runtime (RUST_TEST_THREADS=1): 1022 pass.
• Failure-set diffs (not aggregates) at every iteration; sweeps run with a cleaned compile cache (the runner's TMPDIR object cache survives Rust rebuilds and was masking codegen fixes).

Root causes (before → after)

Root cause	Effect before
HIR array-literal element type = first element's type	[1,true,"x"] claimed Array(Number); === between two such loads compiled to raw fcmp — NaN-boxed bool/string/undefined never equal
sort had no spec-ops path	accessors/sparse/inherited Array.prototype/Object.prototype elements mis-sorted; holes & undefined stringified instead of partitioned to the end; sort/precise-* all red
Array.prototype.{sort,concat,forEach,map,filter,some,every,find*,reduce*,indexOf,lastIndexOf,includes,at,join} were noop thunks	every reflective borrow (obj.sort = Array.prototype.sort) or prototype-chain hit silently returned garbage
Dense entries trusted statically-Array receivers	var x=[]; … x={0:0}; x.sort()/x.splice()/x.length read an ObjectHeader as ArrayHeader (or clean_arr_ptr NULLed it → silent no-op)
concat had no ArraySpeciesCreate; splice never validated length writability	poisoned-ctor/species TypeErrors and 2^32 RangeErrors missing
Inline index/length fast paths ignored descriptors & prototype pollution	reads bypassed index accessors, Array.prototype[i]/Object.prototype[i], custom array [[Prototype]] — fixed via cheap runtime guard flags (relaxed atomics) so unpolluted programs keep the fast path
Proxy/handle id bands (0xF0000+) dereferenced as GcHeaders	Array.prototype.indexOf.call(proxy, …) SIGSEGV; generic engine now routes Proxy traps (incl. revoked-throw)
delete of an accessor-only object property succeeded vacuously	ghost descriptors kept HasProperty true mid-iteration
copyWithin memmove'd stale storage after side-effecting coercions; generic form clamped ToLength at u32::MAX	spec per-index loop on mutation; 2^53-1 lengths; Proxy has/get/set/delete traps

Also: own setter-only accessors now shadow inherited props in the generic engine; fill end-coercions (explicit undefined → len, −∞ → 0); foo.prototype = someArray is stored and linked to instances; sort comparator results go through ToNumber (NaN → +0); callbacks bind this = undefined when no thisArg (explicit thisArg routes the generic engine).

Code-only PR per contributor guidelines — no version bump / changelog (maintainer folds at merge).