Parser: early-error visitors skip labels, logical assignments and with statements

Parent #904; related #899, #920, #921, #922, #923.

On exact commit 877f25b, a compile-only Function-constructor differential matches 5/12 outcomes in tree and required-VM modes, while independent Node/V8 matches 12/12. Seven invalid programs are accepted; four valid controls and an already-rejected global private-name control agree.

Reproductions (each Function call must throw SyntaxError without execution):

Function('class C { m() { label: this.#missing; } }');
Function('class C { m() { let x; x ||= this.#missing; } }');
Function('class C { m() { this.#missing &&= 1; } }');
Function('class C { m() { let x; x ??= this.#missing; } }');
Function('with ({}) { super.x; }');
Function('with ({}) { super(); }');
Function('function f() { with ({}) { super.x; } }');

The shared parser's checkPrivateUsesInNode does not visit labeled_stmt or logical_assign; scanSuperAndArgs does not visit with_stmt. These are ordinary recursive productions, not function/class scope boundaries. ECMA-262's 15.7.7 AllPrivateIdentifiersValid and 8.5.1 Contains require the missing children to participate.

Plan: restore traversal of both logical-assignment operands, labeled bodies, and with object/body; add negative compile and pre-side-effect eval tests in both modes plus valid declared-private-name/sloppy-with controls. Run targeted Debug units and before/after relevant class, logical assignment, with, eval and Function corpus scopes serially with the 3072 MB guard. Do not replace parse-time checks with runtime exceptions.

Baseline evidence retained locally in /private/tmp/zig-js-query-coverage-probe.ps5qiR/ with probe source /private/tmp/zig-js-query-coverage-probe-2026-09-15.js. Runner SHA-256: 26ab0e991077cd646f02c7d1bc8a88a35edd283c7ac10084bf658520236783a0.

No fix or test262 improvement claimed yet.

Landed in ed325e1 on origin/main, under the configured user identity with no trailers. Related #904, #899, #923.

Restored the missing lexical-query traversal of with object/body and private-name traversal of labels and both logical-assignment operands. Invalid private-name references are checked even on an unevaluated RHS. These checks run in the shared parser before either execution tier, not as runtime workarounds.

Verification against exact parent 877f25b:

• Frozen 12-case probe 5/12 → 12/12 in tree and required-VM modes: seven distinct incorrect acceptances fixed, valid controls preserved.
• 78 focused Debug units passed; 0 skipped, failed or leaked. New parser cases cover 12 invalid programs in script/module modes, four valid programs in both modes, and three additional valid sloppy-script controls. Independent Node/V8 compilation confirms all 19 fixture expectations. Runtime tests exercise eval/Function rejection before preceding side effects, plus five valid controls in both modes.
• 9,972 test262 passes / 0 failures before and after, zero flips and zero regressions in these seven measured scopes:

Corpus pin: 4249661388e5d3f92a85186213da140a6481490f. Real clean dependencies: GC 0285ef801dd221a4ae8e88b31a09ae31627657a3; regex c60344dec54f71efe885c62a02e29dfd7ab0f5c0. Production engine sources match the tested isolated checkout exactly; temporary unit-selection instrumentation was removed afterward. Guard: 2701 MB peak process-tree footprint, 30% host memory low-water, serial execution under the shared lock and 3072 MB limit.

Local source, scripts, probe/reference and raw per-scope evidence preserved in /private/tmp/zig-js-query-coverage-landed-evidence.GHw5aC/. Parent runner SHA-256: 26ab0e991077cd646f02c7d1bc8a88a35edd283c7ac10084bf658520236783a0; candidate: efd808f2d2eebabc4f31b207114c73756bf05ff481268cc3c88a4338ab2342ee.

No full-corpus, full-unit-suite, JIT, or performance claim. README/global published numbers remain untouched.