fix(runtime,codegen): new / instanceof / typeof on a class-object value (#1789)

[proggeramlug]

#1789 — new / instanceof / typeof on a class-object value

Part of epic #1785 (design #1772). Builds on the merged #1786 foundation + #1787/#1788 (#1792, #1793). Validated byte-for-byte against node, zero regressions.

What

Make the instance-side operations work when the class is a class-expression value (a heap class object) rather than INT32(class_id). Introduces the per-object discriminator OBJECT_TYPE_CLASS so a class object is distinguished from its instances (which share the template's class_id):

• stamp: ClassExprFresh codegen marks the allocation via js_object_mark_class → object_type = OBJECT_TYPE_CLASS.
• typeof aClassObject → "function" (classes are callable), matching the existing INT32-ClassRef case.
• new (classObjectValue)(args): js_new_function_construct reads the object's class_id and allocates an instance of it → instance methods dispatch, instanceof matches.
• x instanceof classObjectValue: js_instanceof_dynamic now resolves the class_id from a POINTER class object (previously INT32-tag only) and walks the chain.
• shared is_class_object_ptr / is_class_object_value validate the GcHeader before reading object_type.

Why it's safe

Own-field get/set are gated on gc_type/class_id, not on object_type, so the foundation's own-field reads (#1786/#1787/#1788) are unaffected — confirmed by the unchanged gap tests + 17/17 class spot-check. The new tag also keeps class objects out of the instance-shaped PIC (which is keyed by the shared class_id), which is correct.

Coordination with #1790

The OBJECT_TYPE_CLASS discriminator is exactly the marker #1790's #1096 layout descriptor needs to scan a class object precisely (pointer-bearing static-field slots + the prototype link). It now exists — #1790 should reuse it rather than add its own.

Notes / scope

• A class expression only becomes a heap class object when it has static fields/symbols; a static-less class { m(){} } remains an INT32 ClassRef (unchanged path).
• Per-evaluation class objects share the template's class_id, so cross-evaluation instanceof (one make() result vs a different make() result) isn't distinguished — inherent to the shared-class_id model.
• Constructor-body / field-initializer execution via dynamic new on a class-object value is a tracked refinement (static new ClassName() is unchanged).

Gap test test_gap_class_expr_new_instanceof.ts byte-identical to node.

Refs #1789, #1785, #1772.