VM: keep prototype backing storage private

Parent: #498 Related: #1054 / 10bb4e3

Indexed [[Get]] treats collection backing elements as public numbered properties. The generic walker has the same defect in tree mode; #1054's indexed snapshot also inherited it. A separate mapped-arguments prototype divergence was introduced by the snapshot.

Executed before-binary probe (Node, forced tree, required bytecode):

• new Map([["key", 7]])[0] === undefined: true / false / false.
• Array with that Map as prototype, index 0 absent: true / false / false.
• new Set([7])[0] === undefined: true / false / false.
• Array with that Set as prototype, index 0 absent: true / false / false.
• Array inheriting from mapped arguments after updating parameter 0 from 1 to 9: true / true / false.

Collection elements are internal state, not indexed properties. Mapped arguments must read their live parameter cells before dense storage. The repair must cover both execution paths.

Acceptance:

• Remove non-Array backing-storage exposure from generic [[Get]] and indexed snapshots; retain ordinary named data on collection prototypes.
• Preserve live mapped-arguments reads through the canonical exotic path.
• Pin Map/Set prototypes, actual own numbered properties, real Array prototypes, and mapped arguments against Node in isolated/shared modes.
• Normal/unsuppressed TSan tests and targeted before/after Test262 checks pass.

Fixed in 9bbd36e.

Ordinary [[Get]] no longer exposes non-Array collection storage as numbered properties, and the indexed prototype snapshot restricts dense data to Arrays. Explicit numeric named properties on Map/Set instances remain visible. Mapped arguments prototypes retain their live parameter-map semantics.

The saved before binary returned false,false,false,false,true for the five Node-confirmed probes in tree mode and false,false,false,false,false in required-bytecode mode. Both after modes now return Node's true,true,true,true,true.

Validation:

• VM prototype tests: 5/5 normally and 5/5 under unsuppressed TSan.
• Interpreter regression: 2/2 normally and 2/2 under unsuppressed TSan.
• Test262 before/after: Map 204/204, Set 383/383, arguments objects 263/263, and Reflect.get 11/11. All 861 cases have zero failures on both sides; saved outputs are byte-identical, with zero flips.
• Map/Set tree-vs-required-bytecode witnesses: 587/587 agree before and after, zero divergences.
• Quickening inventory and the existing docs manifest pass; 51 pages render and links in all 378 checked files resolve.