Optimizer: admit exact this and new.target activation reads

Parent: #467. Related: #466, #1088, #1089.

Executed boundary on bc83af30: lowering the two-instruction chunks load_this; ret and load_new_target; ret returns UnsupportedChunk; each graph has zero represented nodes because these operations end the represented region. A separate seven-result source probe agrees between Node, tree mode, and required-VM mode: strict null/primitive receivers, ordinary/constructed/lexical new.target, and pre-super this raising ReferenceError. This is an optimizer admission gap, not a claimed language-result bug.

Scope:

• Represent both activation reads as ordered zero-input SSA/runtime effects, with exact pre-effect recovery and exceptional state.
• Execute this through the VM's canonical initialized-this helper, including lexical shared-cell initialization; execute new.target through the VM's existing field-initializer rule.
• Lower both ordinary entry and reducible regions through the existing rooted runtime ABI. Preserve numeric guards, exact steps, exception continuation, and managed recovery roots.
• Refuse activation-eliding direct entry before any effect for artifacts that need the callee's activation context. Preserve the ordinary VM/native activation path and avoid reading caller receiver/new-target state.
• Add native admission, forced-off/on, strict/sloppy/arrow/derived/initializer, shared-realm, moving-GC, and fault witnesses. Record the scoped coverage in optimizer docs; no throughput claim without publication evidence.

Definition of done:

• Both executed chunks lower to real runtime operations and supported-host native artifacts, with no opaque-value refusal.
• Native execution observes exact receiver/new-target/TDZ state; direct activation elision refuses before effects.
• Debug, ReleaseSafe, unsuppressed TSan, no-GIL/moving-GC, OOM/termination/step and seeded differential gates pass.
• Exact-parent affected corpus outcomes and production/docs audits pass; small conventional commit pushed to main.

The remaining upvalue/store, iterator/class/closure, resumable, and irreducible-control work under #467 remains open.

Implemented in 5b73904e, pushed to main over exact parent 30ce39b7. The separately reproduced field-initializer parser prerequisite is fixed in #1091.

load_this and load_new_target are represented SSA values and ordered zero-input runtime effects, with exact pre-effect recovery and exceptional targets. Both entry and reducible-region lowerings use the existing rooted runtime ABI. The callback reads the canonical live initialized-this binding and field-initializer-aware new-target state. Unknown values retain precise roots; direct arithmetic/comparison on activation reads retains runtime coercion rather than assuming Number representation.

An immutable artifact flag is derived during compilation. Activation-eliding direct entry checks it before any body operation, so strict/sloppy/arrow functions cannot accidentally read caller receiver or construction context. Ordinary activation-backed execution remains native. No per-call descriptor scan or new shared mutable state is introduced.

Qualification:

• Eight added optimizer cases bring the full Debug suite to 194/194. The full 194-case ReleaseSafe and unsuppressed TSan suites pass for the same production implementation before the last test-only seed extension; the final extended seed witness also passes both modes afterward.
• Eight seeded sources compare JIT off/on in serialized/no-GIL contexts and independently match Node: Number/String/object receiver coercion, GC callbacks, mixed BigInt/Number failure, plain/constructed new-target comparisons, lexical receiver capture, exact results and callback counts.
• Additional witnesses pin normal and exceptional steps, TDZ and live shared-this-cell state, direct refusal before callbacks, real native completion with correct activation values, lowering OOM cleanup, strict/sloppy/arrow/derived/field contexts, four no-GIL worker activations, and actual object relocation in a native activation-read loop in single-mutator and no-GIL modes.
• Broader JIT: 145 passed / one platform skip / zero failures or leaks. VM/concurrency: four each. Default/verify threadfuzz: 400/300 programs, zero failures.
• Exact-parent outcomes match across 9,145 cases: class statements 4,367; class expressions 4,059; NewTarget 14; arrows 343; this 6; calls 92; functions 264. Zero default-tier failures on both binaries; the same three existing call tree/VM differences. Flips 0 test262 cases.
• Parent/changed runner SHA-256: 5e5d8abf42ec528363b8ededd51c3a45098237294b08ba03c1fd4b770d30fc0c / 1b5a2f568bee2523fa795c7aae5c22e2bce30f635f84a91a4734bcf8dba74595. Completed parent reports from #1091 are reused only after hash verification; every changed-binary phase runs fully.
• Production runner, GC relocation and docs-link audits, and regenerated/checked 51-page docs manifest pass. The optimizer page and its search entry change; public score tables are untouched.

The full combined local unit link remains blocked by #933's unchanged memory cap. Hosted integration is pending. Broader #467 admission and performance acceptance remain open.