Conformance harnesses: publish native bindings on the global object

Parent: #465 Related: #1065, #1066

The packed wg-1.0 Wasm CI smoke fails after live global binding resolution replaced the root environment mirror fallback. In run 37780802328, linking.wast has 0 pass / 114 fail / 4 skip; the first module directive throws ReferenceError: Can't find variable: readModule.

The harness injects readModule only into ctx.env. Its exception-rendering helper likewise injects __pendingExc into the environment despite using it as a script global. These host bindings must be actual properties of the realm global object. The local ECMAScript smoke also registers its assert and assertEq natives only in ctx.env; a local before run scored 0/33 with Throw for every case.

Acceptance:

• Publish harness native and pending-exception bindings as actual realm global properties.
• Restore the local 33-case smoke.
• Restore the pinned linking smoke, checking its nonzero denominator and unchanged exclusions.
• Verify packed corpus behavior and exception reporting in normal, ReleaseSafe, and unsuppressed TSan runs.
• Keep Wasm engine semantics and public evidence unchanged.

Landed in f86ff21. Both conformance harnesses now publish native functions on their actual realm global objects. The packed Wasm reporting helper publishes its pending exception the same way. No engine code or public evidence was changed.

Measured results:

• local smoke: 0/33 → 33/33;
• pinned wg-1.0 linking: 0 pass / 114 fail → 114 pass / 0 fail, preserving all four exclusions;
• full packed wg-1.0 suite in normal, ReleaseSafe, and unsuppressed TSan: 73 files, 18,795 pass, 0 fail/crash, 475 exclusions; each inventory exactly equals the checked tests/wasm/spec/inventory.json;
• a local runtime throw probe preserves TypeError: report probe through exception rendering in all three modes, with no TSan diagnostics.

Flips 0 test262 cases. The smoke runner's independent successful-exit-on-failure defect is tracked in #1068. Full hosted CI remains pending.