JIT: retain evaluation source for optimized member and construction errors

Parent: #892 Related: #890, #893, #459

Problem

The tree walker and bytecode VM now retain JavaScriptCore's exact (evaluating '...') source for member and construction TypeErrors, but optimized native runtime-operation dispatch still drops the source. A warmed AArch64 optimizer differential currently reports:

source                         optimized zig-js
o.m.x                          undefined is not an object
new C()                        1 is not a constructor

JavaScriptCore, the tree walker, and the bytecode VM report:

undefined is not an object (evaluating 'o.m.x')
1 is not a constructor (evaluating 'new C()')

The same probe also reproduces #890 for a failed optimized call, so these are one metadata-lifetime boundary but distinct diagnostic contracts.

Required implementation

• Add artifact-owned per-operation evaluation spans to jit.NativeOperationMetadata, populated from bc.Chunk.evaluation_sites by NativeOperationDescriptor.origin.
• Pass the resolved span into optimized property read/write and construction helpers. Preserve the bytecode ordering rules: computed keys and constructor arguments are evaluated before their corresponding TypeError.
• Deep-copy source bytes into the published artifact; native metadata must not borrow parser/chunk storage. Keep lookup on the throw path so successful native dispatch has no added semantic work.
• Gate named/computed reads and writes plus fixed/spread construction with a warmed optimizer test, and assert native execution actually occurred.

Measurement

Reproduced on 8e5c4a80 with 12 warm-up calls per function via zig-out/bin/test262 --eval; all three affected optimized operations lost their source suffix while the interpreter and VM-focused tests passed.