Optimizer: execute synchronous iterator protocol effects natively

Parent: #467

Synchronous iterator protocol instructions still exit to bytecode before their effects. At 136178a, warmed for-of return/break/exhaustion and array-binding probes produce real optimizer artifacts, but each exits before iter_of; its descriptor belongs to the interpreter-owned side-exit metadata rather than an emitted runtime operation. assert_iter_result, iter_close, and iter_close_completion likewise remain interpreter-owned terminals. The same probes return [1,7,6,1] in Node, JavaScriptCore, and zig-js.

Implement these four effects through canonical semantics with exact pre-effect and completed-effect recovery. Preserve selected iterator identity, receiver, single evaluation, original throw-completion precedence, handler state, roots, and callback-consumed step budgets. Keep asynchronous iterator suspension, for-in enumeration, and remaining general control in #467.

Acceptance:

• SSA and native metadata verifiers cover exact input/output shapes, including the preserved completion pair.
• Executable admission tests demonstrate each instruction in real native artifacts; no blanket semantic fallback is counted as native coverage.
• Forced off/on differentials cover getters/proxies, invalid results, missing/noncallable/throwing return methods, normal and abrupt completion, recursion, GC, budget/termination, seeded serialized/no-GIL runs, and allocation failure.
• Debug, ReleaseSafe, unsuppressed TSan, focused JIT/VM/concurrency, relocation inventory and threadfuzz pass. Compare exact before/after test262 failure sets with nonzero denominators.
• Document the bounded coverage precisely; keep #467 open. The cold combined unit link remains the separate human memory-policy blocker in #933.

Landed in 03f45cbb.

The four synchronous protocol effects now have SSA values, rooted runtime descriptors and exact pre-effect/completed-effect recovery. Closing retains the original completion pair. Verified effectful entry regions preserve admission when the remaining control graph is unsupported, with unchanged bytecode addresses and handler records.

Validation:

• 234 optimizer tests passed in Debug, ReleaseSafe and instrumented TSan with no supplied suppressions.
• Executable descriptors cover all four effects. Corruption and allocation-failure tests validate input spans, root maps, preserved completion values and bounded region exits.
• Forced off/on checks cover 55 Node/JSC protocol traces, 384 budget/stop comparisons, eight seeded workloads in serialized and no-GIL modes with four workers, and recursive callback/GC traces. The recursive production fixture also passed its filtered TSan gate.
• Exact parent comparison against 136178a: 29 subtrees, 5,866 cases, zero default failures on both binaries, zero test262 flips and no new failing or VM-divergence paths. The six existing tail-call distinctions remain unchanged.
• Production JIT: 156 passes plus one platform skip; VM: 5; concurrency: 4; frontend: 79. Default threadfuzz 400 and broad 300 programs passed with zero failures. Library, 51-page documentation build/manifest, link and relocation inventory gates passed.

The combined cold unit link remains the separate memory-policy blocker in #933. Asynchronous suspension, enumeration and broader control remain in #467. The separately executed pre-existing primitive Symbol/BigInt close-result validation defect is tracked in #1100.