fix(hir): late-bind new X() to a class declared later; name the ReferenceError (#8882) - #8892

* fix(hir): late-bind `new X()` to a class declared later; name the ReferenceError

Coop's Next.js App Route fixture died at module init on 0.5.1519 with
the nameless `ReferenceError: identifier is not defined`. The identifier
is `SentinelNode` in next/dist/server/lib/lru-cache.js: the CJS wrap
hoists `LRUCache` out of the module IIFE but never sees `SentinelNode`
(its doc comment closes on the `class` line, and the textual hoister
anchors on `class ` at column 0), so the hoisted constructor's
`new SentinelNode()` is lowered before the `__perry_cjs_factory` body
registers the class. The unresolved-`new` guard from #8643 (905017b,
inside the 1516..1519 window) turned that lowering-time miss into an
unconditional nameless throw; before it, the by-name `Expr::New` bound
at codegen through the module class table, which is why 0.5.1516 loaded.

- `pre_scan_class_decl_names` records every class DECLARATION name in
  the module at any depth; the guard keeps the late-bound by-name
  construction for those.
- Any other unresolved constructor is read off `globalThis` when the
  `new` executes (`js_global_get_or_throw_unresolved`, shared with the
  bare-identifier arm via `unresolved_global_get_expr`), so a
  runtime-created global constructs and a true miss throws
  `ReferenceError: <name> is not defined` -- with the identifier, as
  #8730 and #8882 asked. The compile log names it too, with the same
  "unknown identifier" warning the bare-identifier arm prints.

Regression tests: a hoisted class constructing a sibling declared inside
a later closure keeps `New { class_name }` (fails without the new guard
clause, verified); a `typeof`-guarded `new IntersectionObserver()`
lowers to the named runtime lookup; the #8739 positive control now
expects the named form.

Fixes #8882. Refs #8730.

Claude-Session: https://claude.ai/code/session_01UZJbhb2FTuakurTHPAKQgd

* fix(runtime): make the class registries per image so one process can host several apps

Every class-id-keyed table module init writes — vtables, static methods and
accessors, constructors and flags, the parent map and its dense mirror, names,
lengths, registered ids, bind lengths, the extends-Error / DataView /
typed-array marks, the hasInstance / toStringTag hooks, generic-origin and
fetch-parent maps, anon-shape ids — was a process-global static keyed by a
compile-time class id. Class ids come from a small sequential counter in
codegen, so N dlopen'd copies of one application register the SAME ids with
DIFFERENT func_ptrs (each image's own code addresses) into one HashMap, and
insert is last-writer-wins: after the last image's init every class of every
earlier image dispatched into the last image's code, and only the
last-initialised application worked (#8546). No write order over a shared
table works, so the 21 tables move into one ClassImageTables per image.

A thread resolves its image through a perry_thread_local! handle, falling back
to the process-wide primary image. js_gc_init — codegen's first runtime call in
both `main` and `perry_module_init`, on the thread that runs that image's
module init — enters an image: the first thread to enter owns the primary,
every later one gets a fresh image. perry/thread workers and worker_threads
Workers adopt their spawner's image before running anything, because they never
run module init. A thread that neither entered nor adopted (a pump firing JS
for the primary heap, a reactor thread, a libtest thread) uses the primary,
i.e. the process-global table it saw before, so single-image programs are
unchanged. Each former `static RwLock<..>` is a `static ImageTable<RwLock<..>>`
whose read()/write() return the same guard types, so the call sites are
untouched. Latches and VTABLE_GEN stay process-global on purpose.

Tests: two application threads registering the same class id with different
method addresses each dispatch to their own (sabotage-verified: with the enter
made a no-op the last writer wins and the test fails on the func_ptr); a
spawned worker shares its spawner's image while a second application sees
neither; a thread without an image reads the primary.

Claude-Session: https://claude.ai/code/session_01UZJbhb2FTuakurTHPAKQgd

* docs(changelog): fragment for #8893 (per-image class registries, #8546)

Claude-Session: https://claude.ai/code/session_01UZJbhb2FTuakurTHPAKQgd

* perf(codegen): bound TailCallElim's alloca walk on wide statepoint functions

`TailCallElimPass::markTails` walks the transitive SSA uses of every alloca;
only loads/stores and nocapture call arguments stop it. On a
statepoint-rewritten function an alloca handed to any runtime call reaches
the statepoint token, its gc.relocates and, through their gc-live bundles,
every later statepoint, so each walk covers the whole function and the pass
costs allocas x uses. Coop's Next.js route (jsonwebtoken's bundled entry:
400 allocas, 643k post-RS4GC instructions, 3.4k statepoints, 477k
relocates; ~1.6M visited uses per alloca) held one LLVM worker for ~100
CPU-minutes in that walk on a unit whose remaining `-Os` passes take ~16 s.

Before the optimization pipeline runs, estimate the walk as
`allocas x instructions` per function and stamp
`"disable-tail-calls"="true"` on any function over the budget (default
2^26; `PERRY_LL_TRE_MAX_ALLOCA_WALK=<n>` raises/lowers it, `0`/`off`
disables). That attribute is TRE's own early-out, so the function keeps
every other pass at the requested level (#8421); it gives up exactly
tail-recursion-to-loop and sibling-call codegen, and it is not `optnone`
(#8583). The trip is logged with the function's name and factors, and the
knob is a build/object cache input.

Fixes #8883

Claude-Session: https://claude.ai/code/session_01UZJbhb2FTuakurTHPAKQgd

---------

Co-authored-by: Ralph Küpper <ralph@skelpo.com>
Co-authored-by: Ralph Küpper <ralph3@skelpo.com>

…statement (#8924)

* fix(hir): stash class captures after a `super()` that is not its own statement

Coop's Next.js App Route fixture died at module init on every main since
0.5.1519 with `ReferenceError: Must call super constructor in derived class
before accessing 'this' or returning from derived constructor`, thrown from
`AppRouteRouteModule`'s standalone constructor on `new w.AppRouteRouteModule({…})`.

`synthesize_class_captures` stashes every captured outer local onto the
instance (`this.__perry_cap_<id> = param`) right after `super()`, so a method
the constructor calls can read it (#5437). It located `super()` only as a
top-level `Stmt::Expr(SuperCall)`. The minifier folds the call into a comma
sequence — `super({…}), this.workUnitAsyncStorage = …, …` — so the search
missed, and the early stashes fell back to constructor ENTRY, before
`super()`. That was a silent write onto the pre-allocated receiver until
905017b (#8643, class semantics tail) added the spec derived-`this` TDZ
check (`DERIVED_SUPER_BINDING_STACK`, `check_derived_this_initialized`),
after which every construction throws. 0.5.1516 loads the fixture; every
build from #8643 on fails, masked between #8643 and #8892 by the nameless
`ReferenceError: identifier is not defined` (#8882) that killed init earlier.
The per-image class registries (#8893) and the TRE budget (#8894) are not
involved: the failure reproduces in a single-image native executable and in
a ten-line program on `77b994f6b`+#8892.

The early stash now goes after the statement that completes `super()`,
whatever shape the call takes: a `super();` statement (as before); a comma
sequence that starts with `super(…)`, which is split so the stash sits
between the call and the remaining operands (sound: a statement discards
the sequence's value and the operands still run in order); or, for a call
nested anywhere else (`if (super(), …)`, `try { super() }`, `_this =
super()`), after that whole statement. A derived body with no direct
`super()` at all gets no early stash — `this` is never known to be bound —
and keeps the end-of-body / before-`return` stashes.

Tests: `perry-hir` unit tests lower the comma-sequence and `if`-test shapes
with a captured outer and assert the first `this.__perry_cap_*` stash follows
the `SuperCall` (both fail before the fix); a native e2e test constructs the
Next shape through the runtime `new ns.Class(…)` path, the p-queue `if`
shape, and the plain-statement shape (early stash still feeds a method
called from the constructor).

Refs #8546, #8882.

Claude-Session: https://claude.ai/code/session_01UZJbhb2FTuakurTHPAKQgd

* docs(changelog): fragment for #8924 (capture stash after a nested super())

Claude-Session: https://claude.ai/code/session_01UZJbhb2FTuakurTHPAKQgd

---------

Co-authored-by: Ralph Küpper <ralph@skelpo.com>