fix: preserve private field update and reflection semantics - #8984

… subclass's own elements store (−9.5% / −11.4%) (#8985)

* runtime: lean append and tail pop for the Array-subclass elements store

The store is ours — reached through the meta slot, never a proxy, never a
forwarding stub, its header one read away — but every push went through
`js_array_push_f64`'s full entry for an arbitrary caller pointer, wrapped
in a `RuntimeHandleScope` that rooted the owner and the value even when
the append could not allocate. A fresh profile of the wolf-ecs twins put
`elements_push` at 3.8% + `RuntimeHandleScope::push` at 1.5%, with
`js_array_pop_f64` at 5.1% re-entering the runtime a second time for the
store.

An in-capacity append now stores directly (header read, flag test,
`store_array_slot_resolved`, length bump) and a non-hole tail pop is a
load and a length decrement. Growth still takes the complete entry with
the owner rooted across it and publishes the re-allocated head; holes, an
empty store, and frozen/sealed/no-extend/descriptor-bearing stores keep
the runtime path unchanged.

Test: 64 appends across several capacity classes (asserting the head is
republished on growth), ordered tail pops, a hole popping through the
runtime, an empty-store pop, and a pointer element round-tripping.

Claude-Session: https://claude.ai/code/session_019WVcWKmYsUBnnFB7nBgbBJ

* codegen: the inline pop tier resolves an elements-backed subclass payload

`sub.pop()` reached the inline tier's header gate, failed the
`GC_TYPE_ARRAY` test (the receiver is the object) and called
`js_array_pop_f64`, which then re-derived the store and popped from it —
5.1% of the wolf-ecs entity cycle in a call that only exists to follow one
pointer.

The gate now has a second arm: a `GC_TYPE_OBJECT` receiver loads its meta
record and `ObjectMeta.elements` (word 12), validates that store exactly as
a plain Array receiver is validated (type, not forwarded, none of
FROZEN|SEALED|NO_EXTEND|ARRAY_DESCRIPTORS), and the existing
length/read/take blocks run on it through a payload phi. Everything else —
a null meta, no store, a hole, an empty array, an exotic flag — keeps the
runtime entry.

Claude-Session: https://claude.ai/code/session_019WVcWKmYsUBnnFB7nBgbBJ

* codegen: one derivation of the ObjectHeader meta-slot offset

Five inline tiers each recomputed `object_header_size_bytes(target) -
pointer_size` to reach `ObjectHeader::meta` (the elements store, the spill
buffer, the prototype override). `object_meta_slot_offset_bytes` derives
it once, and the audited object-header-size callsite census drops from 46
to 42.

Also switches the new elements store header read to the sanctioned
`addr_class::try_read_gc_header` accessor instead of a hand-rolled
`GcHeader` cast, which the address-classification ratchet forbids.

Claude-Session: https://claude.ai/code/session_019WVcWKmYsUBnnFB7nBgbBJ

* fix: preserve private field update and reflection semantics (#8984)

* fix: preserve private field update semantics

* chore: add private field fix changelog

---------

Co-authored-by: Ralph Küpper <ralph@skelpo.com>

* chore(changelog): name the fragment for its PR

---------

Co-authored-by: Ralph Küpper <ralph@skelpo.com>
Co-authored-by: x <x@x>