fix: built-in prototype methods resolve as property values (#2058)

[proggeramlug]

Closes #2058.

Problem

Built-in prototype methods (Object.prototype.isPrototypeOf,
Object.prototype.hasOwnProperty, Number.prototype.isPrototypeOf,
Function.prototype.{call,apply,bind}, …) returned undefined when accessed
as property values — via the prototype object or off a primitive receiver.
Direct method calls worked; member-access-as-value did not.

The primitive-receiver case was worse than the issue reported: it SIGSEGV'd.
Perry stores a number like 5 as the bare f64 5.0 (not a NaN-box), so its
bits (0x4014_0000_0000_0000) are neither a NaN-box tag nor a masked heap
pointer — they fell through every guard in js_object_get_field_by_name and
got dereferenced as an ObjectHeader.

typeof Object.prototype.isPrototypeOf   // was: undefined   now: function
typeof Number.prototype.isPrototypeOf   // was: undefined   now: function
typeof Function.prototype.call          // was: undefined   now: function
var n = 5;
typeof n.isPrototypeOf                   // was: SIGSEGV     now: function

Fix

Three small, scoped parts:

1. HIR typeof fold (lower_expr.rs) — extends the existing Function.prototype.call/.apply on builtin prototype methods returns undefined ([].slice.call(arguments)) — generalize #1722 #1777
   <Ctor>.prototype.<method> fold to the Object/Function ctors and to the
   universally-inherited Object.prototype methods (new
   is_known_object_prototype_method helper).

2. Runtime number-receiver guard (field_get_set.rs) — before the generic
   pointer logic, detects a raw finite-f64 number receiver (not a NaN-box, not
   a masked pointer, not a registered Date) and returns a bound-method closure
   via js_class_method_bind for the inherited Object.prototype methods, else
   undefined. Never dereferences — this fixes the SIGSEGV and makes the value
   typeof "function" and callable.

3. Dispatch arms (native_call_method.rs) — adds isPrototypeOf (false for
   primitive receivers, scoped to non-pointer), primitive valueOf (returns the
   value) and toLocaleString (delegates to toString) so the bound values are
   actually callable rather than throwing.

Validation

• New test-files/test_issue_2058_proto_method_values.ts is byte-identical to
  node --experimental-strip-types.
• cargo test -p perry-runtime (700/700) and -p perry-hir suites stay green.
• Regression sweep over the prototype/number/typeof/Date tests is clean.

Out of scope (pre-existing, separate gaps)

Method call accuracy on primitives is unchanged and tracked separately:
n.hasOwnProperty("x")/n.propertyIsEnumerable("x") use the runtime's
deliberately-approximate "truthy receiver" arms (ramda depends on them), and
n.toLocaleString() hits a Date-dispatch confusion. This PR is about the
value-read gap #2058 describes (the typeof reads + the SIGSEGV).