fix(hir,codegen,runtime): class elements/subclass/dstr test262 tail (native-region-safe)

[proggeramlug]

Summary

Targets the biggest remaining class-leaf test262 gaps: language/{statements,expressions}/class/elements (+ subclass, subclass-builtins, dstr). Verified with scripts/test262_subset.py against the node v26 oracle on the 48-core box.

Class dirs (6 target dirs, 4201 judged): 3968 → 4035 pass, parity 94.5% → 96.0% (+67), zero regressions (per-round failure-set diffs).
Broad regression shard (--shard 0/12 built-ins language, 2645 judged): +8 fixed, ZERO regressed vs a from-scratch merge-base baseline build (set-diff, both runs on an idle box).

Three shared root causes

1. GetIterator ignored a patched/deleted Array.prototype[Symbol.iterator] (~50 tests)

js_get_iterator short-circuited every array to the builtin values iterator, so the whole async-gen dstr *-array-prototype / iter-get-err family diverged (sync variants are filtered out by features-applicable.txt, so only async showed). Fix: sticky ARRAY_PROTO_ITERATOR_MODIFIED flag (same shape as ARRAY_PROTO_HAS_INDEX) noted by the symbol-property set and delete paths; when flipped, GetIterator reads the patched method off the prototype, calls it with this === array, and throws TypeError when deleted. Also fixes array_prototype_addr() permanently caching 0 when first probed during runtime init (before global Array materializes).

2. Static-method this was a compile-time class-ref literal (~30 tests)

C.m.call({}) and inherited D.m() ran with this === C baked into the LLVM body, so the (already-correct!) js_private_guard brand checks could never fire, and C.g.call(new C()) for an instance-private read wrongly threw. Fix — no ABI change: a one-shot STATIC_THIS_OVERRIDE thread-local, armed by js_class_static_method_call (arm-if-unarmed so an outer call/apply thisArg wins), the Function.prototype.call/apply arms (only when the target is a static bound-method value), the codegen static-dispatch tower, and inherited direct calls; consumed by a new js_static_this_resolve(lexical_classref) prologue call in compile_static_method. Direct calls keep the lexical class-ref fallback. GC-scanned like IMPLICIT_THIS.

3. this in static field initializers saw the module's implicit this (~10 tests)

The HIR's inline StaticFieldSet stmts (the spec-position evaluation) run in module-init context where Expr::This reads implicit this; the correctly-seeded init_static_fields_late pass ran AFTER user code (too late) and double-evaluated every initializer. Fix: substitute lexical this → Expr::ClassRef in place on class.static_fields at class lowering (in-place matters: closure bodies compile from the class's copy — substituting a stmt-level clone desyncs the closure creation site from its compiled body), and dedup the late pass against inline-emitted fields (also stops initializer side effects firing twice / clobbering user reassignments).

Stragglers fixed

• Static private getters/setters now register on the static-accessor side; the instance-ABI direct accessor call is gated off for static accessors (was an undefined-symbol link error).
• Static fields are real own properties: CLASS_DYNAMIC_PROPS registration at init + getOwnPropertyDescriptor support on class refs (verifyProperty family); computed string-keyed static fields become real props, with the spec TypeError for a static field named prototype.
• NamedEvaluation for anonymous fn initializers (static f = function(){} → .name === "f", incl. #field).
• Annex B __lookupGetter__/__lookupSetter__/__defineGetter__/__defineSetter__ dispatch on class instances.
• for (o.#f of iter) loop heads compile with the brand-guarded private write (was a compile error).

Verification

• Class-dirs sweep: 96.0%, set-diffed each round, 0 regressions.
• Broad shard 0/12 vs merge-base baseline: +8 / −0 (152 → 144 failures).
• cargo test --release -p perry-runtime (RUST_TEST_THREADS=1): 1023 passed, 0 failed.
• native-region gate: compiler_output_regression.py suite --suite native-region-proof → status pass, all 7 workloads, no failed_workloads.
• cargo fmt --all clean, file-size gate OK. No version/changelog edits (maintainer folds at merge).

Deferred tail (~144 remaining in the dirs)

async-gen yield* return/throw protocol (~46, state-machine risk), subclass-builtins exotic constructors (~25), private-on-proxy, per-evaluation private brands (multiple-evaluations family), [self.#f] computed-key visibility, static constructor(){} SWC parse (TS1089), private-method-value .call(plainObj) (BOUND_METHOD by-name re-resolution), static h; descriptor.