fix(ts): preserve readonly index permissions per key domain

Related: #950, #846. TypeScript 5.7.3 treats readonly string, number, and symbol index signatures independently. Reproducer: packages/ts_cli/testdata/issue846-mixed-index/. With a checked-JS owner exporting one type whose string index is readonly and number index is writable, and another with the reverse permissions, TypeScript reports TS2542 only at main.ts:3:1, :7:1, and :8:1. Fresh Home reports TS2542 at every indexed write on lines 3-8, including the three valid mutable-domain writes, and omits the annotated type from each message. Root cause: ts_checker Checker.readonly_index_types is a TypeId-to-void map, and the source-owned indexed object lowering sets one boolean when any index is readonly. Store readonly metadata per key domain, select the effective index signature for computed and named writes (including numeric-string keys), preserve provenance through imported JSDoc and local type lowering, render the correct mixed-index diagnostic type, and add Program/CLI plus negative-control regressions. Do not suppress diagnostics or mark every domain readonly. Parent #950 stays open until parity is verified.

Progress on main: 3794e05 and 119396d. Readonly index metadata is now tracked separately for string, number, and symbol keys and preserved through checked-JS Program transfer and local class/interface/object lowering. The CLI fixture now covers imports, local aliases/interfaces/classes, numeric-string keys, named writes, symbol keys, generic interface inheritance, and class inheritance. Home and TypeScript 5.7.3 produce the same 15 diagnostics in text/order with exit status 2. Guarded checker, Program, tsc-streams, and tsc_main suites exited 0 under the 3,840 MB cap. I am leaving this open while auditing the generic-interface refresh path, which still appears capable of replacing per-domain metadata with a blanket readonly value when it rebuilds an instantiated type. Parent tracking: #950 and #846.

Follow-up from the generic-refresh audit: #952 now tracks a separate concrete type-argument substitution failure in a recursive forward generic interface, with red fixture committed as 23c23c7. The 15-diagnostic mixed readonly-domain fixture remains green on main. I am keeping #951 open for its remaining per-domain refresh audit rather than treating the #952 mismatch as solved by the readonly-domain commits.

Implemented and pushed in 3794e05, 119396d, and 9c0b6e2. The last commit covers the forward-generic refresh path that previously copied one readonly bit to every key domain: refreshed inherited string, number, and symbol signatures now carry their own permissions. TypeScript 5.7.3 and Home produce the same four TS2542 diagnostics for refresh-domain.ts (lines 6, 16, 17, 26), with valid mutable-domain writes accepted. Checker, Program, and exact CLI stream regressions are added; targeted tests, full Program, and test-tsc-streams exited 0 under the 3,840 MB guard. Full checker command also exited 0 but emitted a Zig test-runner failed-command line, so I am not treating that runner output as an unequivocal clean broad result. A separate false generic-index TS2413 found while probing is tracked in #953; it does not change #951 readonly-domain behavior. #950 and #846 remain open.