Arguments: borrowed Array methods must read live mapped parameters

Parent: #498 Related: #1070, #1056

Executed against Node and the 8473c06 engine in tree and required-VM modes. For function f(a) { a = 9; return [Array.prototype.indexOf.call(arguments, 9), Array.prototype.lastIndexOf.call(arguments, 9), Array.prototype.includes.call(arguments, 9)]; } f(1), Node returns [0,0,true]; both zig-js tiers return [-1,-1,false].

The shared arrIndexGet dense shortcut treats mapped arguments as plain Arrays. It reads stale dense backing storage rather than the live parameter map. This helper is used by borrowed Array methods beyond searches.

Acceptance:

• Mapped arguments indexed reads in shared Array method helpers use canonical mapped-cell semantics.
• Pin parameter-to-arguments writes, arguments-to-parameter writes, severed mappings, deletion/inheritance, accessors, GC, and strict/unmapped arguments across tree/required-VM/no-JIT modes.
• Focused normal and unsuppressed TSan tests pass.
• Exact before/after arguments and relevant Array corpus and tree/VM comparisons introduce no new failures/divergences.

No throughput or public conformance-score claim is intended.

Landed in 3c139f9. Shared Array method indexed reads now let Arguments [[Get]] resolve live parameter cells instead of reading the stale dense mirror. Pure Array dense reads keep their existing path.

Validation completed:

• original search witness now returns [0,0,true] in both tree and required-VM modes, matching Node;
• pinned semantic matrix returns true in Node and both engine tiers, covering join, map, slice, reduce, forEach, searches, parameter writes, argument writes, severed maps, deletion/inheritance, accessors, strict arguments, and GC reentry;
• focused normal, unsuppressed TSan, and ReleaseSafe module runs pass 3/3, including four actual no-GIL workers;
• 263 arguments and 3,081 Array corpus cases are byte-identical before/after, all passing; all 3,344 arguments/Array VM witnesses are also identical with zero divergences. Flips 0 test262 cases and zero measured regressions in that scope. Full CI on this commit is pending.

No performance or global conformance-score claim is made. #1070 remains separate for search eligibility and long-length traversal.