VM: reject class constructors at every ordinary-call entry

Parent #465; discovered during the complete positive class census for #819. Related class work: #814 and #820.

At pushed 5308715, test/language/statements/class/subclass/default-constructor-2.js passes in forced tree-walker mode but fails required bytecode: Expected a TypeError to be thrown but no exception was thrown at all. Its first assertions call a base class and its default derived constructor without new. The same required-tier failure remains with the #819 candidate; it is not a computed-key regression.

The interpreter ordinary-call entry already rejects is_class_constructor with a callee-realm TypeError. VM callValue dispatches chunk-backed functions directly to runFunction; trampoline/inline paths also enter buildActivation. Those shared VM entry paths currently lack the corresponding class [[Call]] guard. Fast numeric/arguments/native paths need auditing too, not only the simple call opcode.

Acceptance: reject every ordinary class call before parameter/default/field/body effects, after caller argument evaluation, using the existing error contract and the class realm. Cover base/derived/default/named/anonymous constructors; direct, method, spread, tail, bound, Proxy, Reflect and cross-realm entries; preserve valid new/super/Reflect.construct behavior. Include forced-tier, native entry, allocation-failure and shared no-GIL checks and exact-parent class census evidence. Do not add syntax rejection, AST fallback, duplicated error-message policy or a native stack/queue/job lifecycle redesign.

This issue records a reproduced remaining failure, not a completed implementation.

The ordinary class-call candidate improves the 23 local forced-tier pairs from 7/23 to 23/23; automatic execution, Node 24.18.0 and JSC are 23/23. Complete positive class census gains exactly subclass/default-constructor-2.js: statements 3706/3712 -> 3707/3712, expressions remain 3448/3448, no measured regressions. These are first-candidate measurements, before the separate #822 change.

All seven focused Debug tests now pass together with #822, including JIT off/on call forms, actual moving GC, async/async-generator bodies, no-GIL lanes, all-allocation replay for value/driver/inline entries, and a real optimizer call operation that deoptimizes to its exact catch handler. The original native test incorrectly counted only complete native returns; the corrected evidence asserts native entry, callback execution and deoptimization separately.

The new cross-realm test exposed #822, an existing name-based Error instanceof fallback. #823 independently tracks mutable error-prototype lookup, previously masked by that fallback. No cross-realm assertion was weakened. These changes remain uncommitted while sanitizer and expanded corpus validation run.

Pushed fix(vm): reject ordinary class calls before activation (#821). Seven focused tests pass Debug and unsuppressed ReleaseSafe+TSan. All 23 local probes pass in automatic, forced tree/VM, Node and JSC; forced pairs improve 7/23 -> 23/23. Positive class statements improve 3706/3712 -> 3707/3712 (default-constructor-2.js); expressions stay 3448/3448, no measured regression among 7160 pairs. Default class corpus remains 8426/8426. Seed-1 default 400 and verify 300 fuzz programs pass. The optimizer test proves entry/runtime-operation/exceptional-deoptimization activity, not a complete-native return. Full native-sharded Debug (2157 linked tests) is running. This is not a terminal CI-green claim; #722 and #792 have existing lifecycle assertions. Related identity fix #822 landed separately; mutable realm intrinsic construction remains #823.

Terminal local integration for pushed e24c4fa: native zig build test-parallel, four shards, 2156 passed + 1 platform skip = 2157 linked tests; zero failures/leaks, 779.3s. The binary/source hashes and all shard logs/plan are retained. Current CI is 33211154123, still pending; no terminal CI-green claim.

Closing with terminal combined-main integration evidence: CI 33211154123 at e24c4fa completed successfully: 53 successful checks, one skipped nightly-only check, zero failed/cancelled checks. The implementation fix(vm): reject ordinary class calls before activation (#821) is in that revision. This completes the pending integration condition alongside the scoped local/conformance evidence recorded above. Separately discovered Error-intrinsic, Array-realm, prototype-type and restriction-path defects remain open in #823, #824, #825 and #826; this closure does not claim those are fixed.