JIT: lower environment reads and coercive operators inside OSR regions

Parents: #466, #469 Performance evidence: #473 Follows: #1014, #1015

Executed evidence

After e11e1a1 compacts the exact frozen representativeJson inner loop from 147 function-wide nodes to 43 region nodes, all loop lowerers reach operation selection and reject. The exact region inventory contains two load_var nodes (the JSON reads) and one bit_and node (the & 65535 update). Both already have exact effect frame states, exceptional targets, input arity, native runtime ABI dispatch, and straight-line lowering; appendBlockOperations simply omits them from region lowering and falls through to UnsupportedChunk.

Scope

• Stage zero-input global environment reads through the existing exact effect-state/native-operation path inside selected regions.
• Stage the already-supported unary/coercive and two-input operator families through rooted region scratch inputs, preserving operand order and exceptional targets.
• Reuse the narrow per-op native ABI and its exact deopt state; do not hide the bytecode interpreter behind a region call.
• Mark numeric results only from the existing required-numeric proof and validate them on return.

Acceptance

• Focused OSR tests execute a global read and coercive binary operator with exact result, exception, step, and side-exit recovery behavior.
• Moving-GC stack maps root every staged managed input and rewrite recovery state.
• The exact representativeJson function publishes a native region or exposes a newly measured, separately filed boundary.
• Forced JIT off/on output and checksums agree; no-GIL and TSan remain race-free.
• Exact-parent attribution proves increased native transfer without a frozen control regression.

Completed by 0efe89e, with reusable callback attribution added in a4d47ae. Current real-GC loop tests pass 14/14 and the no-GIL plus unsuppressed TSan seeded optimizer differential passes 3/3. Frozen production attribution preserves checksum 324952086, publishes two optimizer artifacts, records 17,113 OSR entries/deoptimizations, and reduces scored VM dispatch from 23,184,279 to 9,224,978. The new histogram reconciles exactly to 1,440,643 runtime callbacks: load_var 480,214; get_prop 480,215; call_with_this 480,214. This proves the environment/coercion staging is live and identifies the next independent stable-global/property/call residency boundary in #1024.